The Cisco IOS XE router must restrict BGP connections to known IP addresses of neighbor routers from trusted Autonomous Systems (AS).

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-74135	CISR-RT-000021	SV-88809r2_rule		Medium

Description
Advertisement of routes by an Autonomous System for networks that do not belong to any of its trusted peers pulls traffic away from the authorized network. This causes a DoS on the network that allocated the block of addresses and may cause a DoS on the network that is inadvertently advertising it as the originator. It is also possible that a misconfigured or compromised router within the network could redistribute Interior Gateway Protocol routes into Border Gateway Protocol, thereby leaking internal routes.

Description

Advertisement of routes by an Autonomous System for networks that do not belong to any of its trusted peers pulls traffic away from the authorized network. This causes a DoS on the network that allocated the block of addresses and may cause a DoS on the network that is inadvertently advertising it as the originator. It is also possible that a misconfigured or compromised router within the network could redistribute Interior Gateway Protocol routes into Border Gateway Protocol, thereby leaking internal routes.

STIG	Date
Cisco IOS XE Release 3 RTR Security Technical Implementation Guide	2018-12-20

Details

Check Text ( C-74221r2_chk )
Review the router configuration and compare it against the network documentation (topology diagrams and peering agreements). Verify that each BGP peering session is configured with the correct IP address and remote Autonomous System Number (ASN). If any BGP peering session is not configured with the correct IP address and remote Autonomous System Number (ASN), this is a finding.

Fix Text (F-80677r2_fix)
Configure each BGP peering session to the specific IP address of the peer router and remote Autonomous System Number (ASN) assigned to the organization controlling that peer.