Rule ID
SV-283870r1203859_rule
Version
V1R1
CCIs
Outbound route advertisements belonging to the core can result in traffic either looping or being black holed, or at a minimum, using a nonoptimized path.
Review the router configuration to verify a filter is defined to block route advertisements for prefixes that belong to the IP core. Verify a BGP "Export Policy" is applied to the neighbor using the command below: - show router bgp neighbor 10.50.10.2 detail | match "Export Policy" Export Policy : Export-Route-EBGP If the router is not configured to reject outbound route advertisements that belong to the IP core, this is a finding.
Configure all eBGP routers to filter outbound route advertisements belonging to the IP core, as shown in the example below: Create a prefix-list: - configure router policy-options - config>router>policy-options# begin - config>router>policy-options# prefix-list "Core-IP-Prefix" - config>router>policy-options>prefix-list# prefix 192.168.100.10/32 - config>router>policy-options>prefix-list# exit Create a policy statement: - config>router>policy-options# policy-statement "Export-Route-EBGP" - config>router>policy-options>policy-statement# entry 10 - config>router>policy-options>policy-statement>entry# from prefix-list "Core-IP-Prefix" - config>router>policy-options>policy-statement>entry# action drop - config>router>policy-options>policy-statement>entry>action# exit - config>router>policy-options>policy-statement>entry# exit - config>router>policy-options>policy-statement# exit - config>router>policy-options# commit - config>router>policy-options# exit all Apply the export policy to the BGP: - configure router bgp group "eBGP-65560" export "Export-Route-EBGP"