V-283841

Discussion

The route processor handles traffic destined to the router, which is the key component used to build forwarding paths and is instrumental with all network management functions. Therefore, any disruption or denial-of-service attack to the route processor can result in mission-critical network outages.

Check Content

Review the access control list (ACL) or filter for the router receive path and verify it will only process specific management plane and control plane traffic from specific sources, as shown in the example below:

- show system security cpm-filter ip-filter entry 10

CPM IP Filter Entry

Entry Id           : 10
Description        : (Not Specified)
-------------------------------------------------------------------------------
Filter Entry Match Criteria :
-------------------------------------------------------------------------------
Log Id             : n/a
Src. IP            : 100.100.100.100/32
Src. Port          : n/a
Dst. IP            : n/a
Dest. Port         : n/a
Protocol           : icmp               Dscp               : Undefined

- show system security cpm-filter ipv6-filter entry 20

CPM IPv6 Filter Entry

Entry Id           : 20
Description        : (Not Specified)
-------------------------------------------------------------------------------
Filter Entry Match Criteria :
-------------------------------------------------------------------------------
Log Id             : n/a
Src. IP            : 2001:acad:1234:200::2/128

If the router is not configured with a receive-path filter to restrict traffic destined to itself, this is a finding.