Rule ID
SV-283855r1203814_rule
Version
V1R1
CCIs
The effects of prefix deaggregation can degrade router performance due to the size of routing tables and can result in black-holing legitimate traffic. Initiated by an attacker or a misconfigured router, prefix deaggregation occurs when the announcement of a large prefix is fragmented into a collection of smaller prefix announcements.
This requirement is not applicable for the DODIN Backbone. Use the command below to verify the import policy is applied: - show router bgp neighbor 10.50.10.2 detail | match "Import Policy" Import Policy : Accept-routes If the router is not configured to limit the prefix size on any inbound route advertisement to /24 or the least significant prefixes issued to the customer, this is a finding.
Ensure all eBGP routers are configured to limit the prefix size on any route advertisement to /24 or the least significant prefixes issued to the customer, as shown in the example below: Create Prefix-List: - configure router policy-options - config>router>policy-options# begin - config>router>policy-options# prefix-list "Filter-Prefix-Length" - config>router>policy-options>prefix-list# prefix 0.0.0.0/0 prefix-length-range 8-24 Create a policy statement: - config>router>policy-options# policy-statement "Accept-routes" - config>router>policy-options>policy-statement# entry 10 - config>router>policy-options>policy-statement>entry# from prefix-list "Filter-Prefix-Length" - config>router>policy-options>policy-statement>entry# action accept - config>router>policy-options>policy-statement>entry>action# back - config>router>policy-options>policy-statement# default-action reject - config>router>policy-options>policy-statement# back - config>router>policy-options# commit - config>router>policy-options# exit all Apply import policy: - configure router bgp group "eBGP" import "Accept-routes"