V-283900

Discussion

As a best practice, a service provider should only accept customer prefixes that have been assigned to that customer and any peering autonomous systems. A multihomed customer with BGP speaking routers connected to the internet or other external networks could be breached and used to launch a prefix deaggregation attack. Without ingress route filtering of customers, the effectiveness of such an attack could impact the entire IP core and its customers.

Check Content

Review the BGP router configuration to verify routing policies are defined to only accept routes for prefixes that belong to each specific customer. 

Verify the prefix-list, policy-statement, and import policy are applied to the eBGP group using the commands below:

- show router policy prefix-list "Customer Prefix"

prefix 192.168.100.0/24 prefix-length-range 24-32

- show router policy "Import Customer Prefix"

    entry 10
        from
            prefix-list "Customer Prefix"
        exit
        action accept
        exit
    exit
    default-action drop
    exit

- show router bgp group "eBGP" detail | match "Import Policy"

Import Policy    : Import Customer Prefix

If the router is not configured to reject inbound route advertisements from each CE router for prefixes that are not allocated to that customer, this is a finding.