← Back to Nokia Service Router OS 25.x Router Security Technical Implementation Guide

V-283907

CAT II (Medium)

The Nokia Border Gateway Protocol (BGP) router must be configured to reject inbound route advertisements for any Bogon prefixes.

Rule ID

SV-283907r1203970_rule

STIG

Nokia Service Router OS 25.x Router Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-001368

Discussion

Accepting route advertisements for Bogon prefixes can result in the local autonomous system (AS) becoming a transit for malicious traffic as it will in turn advertise these prefixes to neighbor autonomous systems.

Check Content

Review the router configuration to verify it will reject routes of any Bogon prefixes.

Verify the prefix list using the command below: 

- show router policy prefix-list "Bogon Prefixes"

prefix 0.0.0.0/8 prefix-length-range 8-32
prefix 10.0.0.0/8 prefix-length-range 8-32
prefix 100.64.0.0/10 prefix-length-range 10-32
prefix 127.0.0.0/8 prefix-length-range 8-32
prefix 169.254.0.0/16 prefix-length-range 16-32
prefix 172.16.0.0/12 prefix-length-range 12-32
prefix 192.0.2.0/24 prefix-length-range 24-32
prefix 192.88.99.0/24 prefix-length-range 24-32
prefix 192.168.0.0/16 prefix-length-range 16-32
prefix 198.18.0.0/15 prefix-length-range 15-32
prefix 198.51.100.0/24 prefix-length-range 24-32
prefix 203.0.113.0/24 prefix-length-range 24-32
prefix 224.0.0.0/4 prefix-length-range 4-32
prefix 240.0.0.0/4 prefix-length-range 4-32

- show router policy prefix-list "Permit Prefix"

prefix 0.0.0.0/0 prefix-length-range 8-32

Verify the policy statement using the command below:

- show router policy "IMPORT-BGP-Prefix"
    entry 10
        from
            prefix-list "Bogon Prefixes"
        exit
        action drop
        exit
    exit
    entry 20
        from
            prefix-list "Permit Prefix"
        exit
        action accept
        exit
    exit
    default-action drop
    exit

Verify the policy is applied to the eBGP group using the command below:

- show router bgp group "eBGP" detail  | match "Import Policy"
Import Policy    : IMPORT-BGP-Prefix

If the router is not configured to reject inbound route advertisements for any Bogon prefixes, this is a finding.

Fix Text

Ensure all eBGP routers are configured to reject inbound route advertisements for any Bogon prefixes.

Create prefix-lists using the configuration below:

- configure router policy-options
- config>router>policy-options# begin
- config>router>policy-options# prefix-list "Bogon Prefixes"
- config>router>policy-options>prefix-list$ prefix 0.0.0.0/8 prefix-length-range 8-32
- config>router>policy-options>prefix-list$ prefix 10.0.0.0/8 prefix-length-range 8-32
- config>router>policy-options>prefix-list$ prefix 100.64.0.0/10 prefix-length-range 10-32
- config>router>policy-options>prefix-list$ prefix 127.0.0.0/8  prefix-length-range 8-32
- config>router>policy-options>prefix-list$ prefix 169.254.0.0/16 prefix-length-range 16-32
- config>router>policy-options>prefix-list$ prefix 172.16.0.0/12 prefix-length-range 12-32
- config>router>policy-options>prefix-list$ prefix 192.0.2.0/24 prefix-length-range 24-32
- config>router>policy-options>prefix-list$ prefix 192.88.99.0/24 prefix-length-range 24-32
- config>router>policy-options>prefix-list$ prefix 192.168.0.0/16 prefix-length-range 16-32
- config>router>policy-options>prefix-list$ prefix 198.18.0.0/15 prefix-length-range 15-32
- config>router>policy-options>prefix-list$ prefix 198.51.100.0/24 prefix-length-range 24-32
- config>router>policy-options>prefix-list$ prefix 203.0.113.0/24 prefix-length-range 24-32
- config>router>policy-options>prefix-list$ prefix 224.0.0.0/4 prefix-length-range 4-32
- config>router>policy-options>prefix-list$ prefix 240.0.0.0/4 prefix-length-range 4-32
- config>router>policy-options>prefix-list$ exit
- config>router>policy-options# prefix-list "Permit Prefix"
- config>router>policy-options>prefix-list$ prefix 0.0.0.0/0 prefix-length-range 8-32
- config>router>policy-options>prefix-list$ exit

Create a policy statement using the configuration below:

- config>router>policy-options# policy-statement IMPORT-BGP-Prefix
- config>router>policy-options>policy-statement$ entry 10
- config>router>policy-options>policy-statement>entry$ from prefix-list "Bogon Prefixes"
- config>router>policy-options>policy-statement>entry$ action drop
- config>router>policy-options>policy-statement>entry>action$ exit
- config>router>policy-options>policy-statement>entry$ exit
- config>router>policy-options>policy-statement$ entry 20
- config>router>policy-options>policy-statement>entry$ from prefix-list "Permit Prefix"
- config>router>policy-options>policy-statement>entry$ action accept
- config>router>policy-options>policy-statement>entry>action$ exit
- config>router>policy-options>policy-statement>entry$ exit
- config>router>policy-options>policy-statement$ default-action drop
- config>router>policy-options>policy-statement>default-action$ exit
- config>router>policy-options>policy-statement$ exit
- config>router>policy-options# commit

Apply the policy to the eBGP group using the configuration below:

- configure router bgp group "eBGP" import "IMPORT-BGP-Prefix"