V-217053

Discussion

Accepting route advertisements for Bogon prefixes can result in the local autonomous system (AS) becoming a transit for malicious traffic as it will in turn advertise these prefixes to neighbor autonomous systems.

Check Content

Review the router configuration to verify that it will reject BGP routes for any Bogon prefixes.

Verify a prefix list has been configured containing the current Bogon prefixes as shown in the example below.

policy-options {
    prefix-list BOGON_PREFIXES {
        0.0.0.0/8;
        10.0.0.0/8;
        100.64.0.0/10;
        127.0.0.0/8;
        169.254.0.0/16;
        172.16.0.0/12;
        192.0.0.0/24;
        192.0.2.0/24;
        192.168.0.0/16;
        198.18.0.0/15;
        198.51.100.0/24;
        203.0.113.0/24;
        224.0.0.0/4;
        240.0.0.0/4;
    }
}

Verify that a policy has been configured to reject the Bogon prefixes.

policy-options {
    …
    …
    …
    policy-statement FILTER_ROUTES {
        term REJECT_BOGONS {
            from {
                prefix-list BOGON_PREFIXES;
            }
            then reject;
        }
        term ACCEPT_OTHERS {
            then accept;
        }
    }
}

Verify that the configured policy to filter Bogons has been applied to external BGP peers as shown in the example below.

protocols {
    bgp {
        group GROUP_AS4 {
            type external;
            import FILTER_ROUTES;
            peer-as 4;
            neighbor x.x.x.x;
        }
    }

If the router is not configured to reject inbound route advertisements for any Bogon prefixes, this is a finding.