← Back to Nokia Service Router OS 25.x Router Security Technical Implementation Guide

V-283908

CAT II (Medium)

The Nokia Border Gateway Protocol (BGP) router must be configured to reject inbound route advertisements for any prefixes belonging to the local autonomous system (AS).

Rule ID

SV-283908r1203973_rule

STIG

Nokia Service Router OS 25.x Router Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-001368

Discussion

Accepting route advertisements belonging to the local AS can result in traffic looping or being black holed, or at a minimum using a nonoptimized path.

Check Content

Review the router configuration to verify it will reject routes belonging to the local AS.

Verify the prefix lists using the command below: 

- show router policy prefix-list "Deny Prefixes"

prefix 0.0.0.0/8 prefix-length-range 8-32
prefix 10.13.1.0/24 prefix-length-range 24-32

- show router policy prefix-list "Permit Prefix"

prefix 0.0.0.0/0 prefix-length-range 8-32

Verify the policy statement using the command below: 

- show router policy "IMPORT-BGP-PREFIX"
    entry 10
        from
            prefix-list "Deny Prefixes"
        exit
        action drop
        exit
    exit
    entry 20
        from
            prefix-list "Permit Prefix"
        exit
        action accept
        exit
    exit
    default-action drop
    exit

Verify the policy is applied to the eBGP group using the command below: 

- show router bgp group "eBGP" detail | match "Import Policy"
Import Policy    : IMPORT-BGP-PREFIX

If the router is not configured to reject inbound route advertisements belonging to the local AS, this is a finding.

Fix Text

Ensure all eBGP routers are configured to reject inbound route advertisements for any prefixes belonging to the local AS.

Create prefix lists using the configuration below: 

- configure router policy-options
- config>router>policy-options# prefix-list "Deny Prefixes"
- config>router>policy-options>prefix-list$ prefix 0.0.0.0/8 prefix-length-range 8-32
- config>router>policy-options>prefix-list$ prefix 10.13.1.0/24 prefix-length-range 24-32
- config>router>policy-options>prefix-list$ exit
- config>router>policy-options# prefix-list "Permit Prefix"
- config>router>policy-options>prefix-list# prefix 0.0.0.0/0 prefix-length-range 8-32

Create a policy statement using the configuration below: 

- config>router>policy-options# policy-statement "IMPORT-BGP-Prefix"
- config>router>policy-options>policy-statement# entry 10
- config>router>policy-options>policy-statement>entry$ from prefix-list "Deny Prefixes"
- config>router>policy-options>policy-statement>entry$ action drop
- config>router>policy-options>policy-statement>entry>action$ exit
- config>router>policy-options>policy-statement>entry$ exit
- config>router>policy-options>policy-statement# entry 20
- config>router>policy-options>policy-statement>entry$ from prefix-list "Permit Prefix"
- config>router>policy-options>policy-statement>entry$ action accept
- config>router>policy-options>policy-statement>entry>action$ exit
- config>router>policy-options>policy-statement>entry$ exit
- config>router>policy-options>policy-statement# default-action drop
- config>router>policy-options>policy-statement>default-action# exit
- config>router>policy-options>policy-statement# exit
- config>router>policy-options# commit
- config>router>policy-options# exit all

Apply the policy to the eBGP group using the configuration below: 

- configure router bgp group "eBGP" import "IMPORT-BGP-Prefix"