← Back to Cisco IOS XE Switch RTR Security Technical Implementation Guide

V-221027

CAT II (Medium)

The Cisco BGP switch must be configured to reject outbound route advertisements for any prefixes belonging to the IP core.

Rule ID

SV-221027r929070_rule

STIG

Cisco IOS XE Switch RTR Security Technical Implementation Guide

Version

V3R4

CCIs

CCI-001097

Discussion

Outbound route advertisements belonging to the core can result in traffic either looping or being black holed, or at a minimum, using a nonoptimized path.

Check Content

Step 1: Verify that a prefix list has been configured containing prefixes belonging to the IP core.

ip prefix-list FILTER_CORE_PREFIXES seq 5 deny x.1.1.0/24 le 32
ip prefix-list FILTER _CORE_PREFIXES seq 10 deny x.1.2.0/24 le 32
ip prefix-list FILTER _CORE_PREFIXES seq 15 permit 0.0.0.0/0 ge 8

Step 2: Verify that the prefix lists has been applied to all external BGP peers as shown in the example below:

router bgp xx
 no synchronization
 bgp log-neighbor-changes
 neighbor x.1.4.12 remote-as yy
 address-family ipv4 
  neighbor x.1.4.12 prefix-list FILTER _CORE_PREFIXES out

If the switch is not configured to reject outbound route advertisements for prefixes belonging to the IP core, this is a finding.

Fix Text

Step 1: Configure a prefix list for containing all customer and local AS prefixes as shown in the example below:

R1(config)#ip prefix-list FILTER_CORE_PREFIXES deny x.1.1.0/24 le 32
R1(config)#ip prefix-list FILTER _CORE_PREFIXES deny x.1.2.0/24 le 32
R1(config)#ip prefix-list FILTER _CORE_PREFIXES permit 0.0.0.0/0 ge 8

Step 2: Apply the prefix list filter outbound to each CE neighbor as shown in the example.

router bgp xx
 address-family ipv4
  neighbor x.1.4.12 prefix-list FILTER _CORE_PREFIXES out