← Back to Nokia Service Router OS 25.x Router Security Technical Implementation Guide

V-283828

CAT III (Low)

The Nokia Border Gateway Protocol (BGP) router must be configured to reject route advertisements from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

Rule ID

SV-283828r1203733_rule

STIG

Nokia Service Router OS 25.x Router Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-001368

Discussion

Verifying the path a route has traversed will ensure the local AS is not used as a transit network for unauthorized traffic. To ensure the local AS does not carry any prefixes that do not belong to any customers, all Provider Edge (PE) routers must be configured to reject routes with an originating AS other than that belonging to the customer.

Check Content

This requirement is not applicable for the DODIN Backbone. 

Review the router configuration to verify the router is configured to deny updates received from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

Review the router policy as-path and policy statement, as shown in the example below: 

- show router policy as-path "accept-65560"
as-path "accept-65560" expression "^65560$"

- show router policy "Accept-routes"
    entry 10
        from
            protocol bgp
            as-path "accept-65560"
        exit
        action accept
        exit
    exit
    default-action drop
    exit

Review the import policy, as shown in the example below:

- show router bgp neighbor 10.50.10.2 detail | match "Import Policy"
Import Policy        : Accept-routes

If the router is not configured to reject updates from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer, this is a finding.

Fix Text

Configure the router to reject updates from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

Configure the as-path, as shown in the example below:

- configure router policy-options
- config>router>policy-options# begin
- config>router>policy-options# as-path "accept-65560"
- config>router>policy-options>as-path# expression "^65560$"
- config>router>policy-options>as-path#
- config>router>policy-options>as-path# exit

Configure the policy statement, as shown in the example below:

- config>router>policy-options# policy-statement "Accept-routes"
- config>router>policy-options>policy-statement# entry 10
- config>router>policy-options>policy-statement>entry# from protocol bgp
- config>router>policy-options>policy-statement>entry# from as-path "accept-65560"
- config>router>policy-options>policy-statement>entry# action accept
- config>router>policy-options>policy-statement>entry>action# exit
- config>router>policy-options>policy-statement>entry# exit
- config>router>policy-options>policy-statement# default-action drop
- config>router>policy-options>policy-statement>default-action# exit
- config>router>policy-options>policy-statement# exit
- config>router>policy-options# commit
- config>router>policy-options# exit all

Apply the import policy, as shown in the example below:

- configure router bgp group "eBGP-65560" import "Accept-routes"