V-216778

Discussion

Accepting route advertisements belonging to the local AS can result in traffic looping or being black holed, or at a minimum using a non-optimized path.

Check Content

Review the router configuration to verify that it will reject routes belonging to the local AS.

Step 1: verify that an inbound route policy has been configured for each external neighbor as shown in the example below.

router bgp xx
 address-family ipv4 unicast
 !
 neighbor x.1.23.3
  remote-as yy
  keychain YYY_KEY_CHAIN
  ttl-security
  address-family ipv4 unicast
   route-policy BGP_FILTER_INBOUND in
  !
 !
 neighbor x.1.24.4
  remote-as zz
  keychain ZZZ_KEY_CHAIN
  ttl-security
  address-family ipv4 unicast
   route-policy BGP_FILTER_INBOUND in
 !
!

Step 2: Review the route policy to determine if it is filtering at a minimum local prefixes as shown in the example below.

route-policy BGP_FILTER_INBOUND
  if destination in LOCAL_PREFIX then
    drop
  else
    pass
  endif
end-policy 

Note: If bogons are also filtered per previous requirement, the route policy would look similar to the following example:

route-policy BGP_FILTER_INBOUND
  if destination in BOGON_PREFIXES then
    drop
  elseif destination in LOCAL_PREFIX then
    drop
  else
    pass
  endif
end-policy

Step 3: Review the prefix set referenced in the route policy above to determine if it includes the local global prefix as shown in the example below.

prefix-set LOCAL_PREFIX
 x.13.1.0/24 le 32
end-set

If the router is not configured to reject inbound route advertisements belonging to the local AS, this is a finding.