The Juniper BGP router must be configured to reject route advertisements from BGP peers that do not list their autonomous system (AS) number as the first AS in the AS

The Juniper BGP router must be configured to reject route advertisements from BGP peers that do not list their autonomous system (AS) number as the first AS in the AS_PATH attribute.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-90901	JUNI-RT-000530	SV-101111r1_rule		Low

Description
Verifying the path a route has traversed will ensure the IP core is not used as a transit network for unauthorized or possibly even Internet traffic. All autonomous system boundary routers (ASBRs) must ensure updates received from eBGP peers list their AS number as the first AS in the AS_PATH attribute.

STIG	Date
Juniper Router RTR Security Technical Implementation Guide	2018-11-15

Details

Check Text ( C-90165r2_chk )
Review the router configuration to verify the router is configured to deny updates received from eBGP peers that do not list their AS number as the first AS in the AS_PATH attribute. Verify a policy has been configured to filter AS_PATH attribute for received BGP advertisements as shown in the example below. policy-options { … … … policy-statement FILTER_AS4 { term ALLOW_AS4 { from as-path PEER_AS4; then accept; } term ELSE_REJECT { then reject; } } … … … as-path PEER_AS4 "^6$"; } Note: the characters “^” and “$” representing the beginning and the end of the expression respectively are optional and are implicitly defined if omitted. Verify that the import policy has been applied to all external BGP peers as shown in the example below. protocols { bgp { group GROUP_AS4 { type external; import [FILTER_AS4 FILTER_ROUTES]; peer-as 4; neighbor x.x.x.x; } If the router is not configured to reject updates from peers that do not list their AS number as the first AS in the AS_PATH attribute, this is a finding.

Check Text ( C-90165r2_chk )

Review the router configuration to verify the router is configured to deny updates received from eBGP peers that do not list their AS number as the first AS in the AS_PATH attribute.

Verify a policy has been configured to filter AS_PATH attribute for received BGP advertisements as shown in the example below.

policy-options {
…
…
…
policy-statement FILTER_AS4 {
term ALLOW_AS4 {
from as-path PEER_AS4;
then accept;
}
term ELSE_REJECT {
then reject;
}
}
…
…
…
as-path PEER_AS4 "^6$";
}

Note: the characters “^” and “$” representing the beginning and the end of the expression respectively are optional and are implicitly defined if omitted.

Verify that the import policy has been applied to all external BGP peers as shown in the example below.

protocols {
bgp {
group GROUP_AS4 {
type external;
import [FILTER_AS4 FILTER_ROUTES];
peer-as 4;
neighbor x.x.x.x;
}

If the router is not configured to reject updates from peers that do not list their AS number as the first AS in the AS_PATH attribute, this is a finding.

Fix Text (F-97209r2_fix)
Configure the router to deny updates received from eBGP peers that do not list their AS number as the first AS in the AS_PATH attribute. Configure a policy to filter the AS_PATH as shown in the example below. [edit policy-options] set as-path PEER_AS4 "^4$" set policy-statement FILTER_AS4 term ALLOW_AS4 from as-path PEER_AS4 set policy-statement FILTER_AS4 term ALLOW_AS4 then accept set policy-statement FILTER_AS4 term ELSE_REJECT then reject Apply the import policy as shown in the example below. [edit protocols bgp group GROUP_AS4] set import [FILTER_AS4 FILTER_ROUTES]

Fix Text (F-97209r2_fix)

Configure the router to deny updates received from eBGP peers that do not list their AS number as the first AS in the AS_PATH attribute.

Configure a policy to filter the AS_PATH as shown in the example below.

[edit policy-options]
set as-path PEER_AS4 "^4$"
set policy-statement FILTER_AS4 term ALLOW_AS4 from as-path PEER_AS4
set policy-statement FILTER_AS4 term ALLOW_AS4 then accept
set policy-statement FILTER_AS4 term ELSE_REJECT then reject

Apply the import policy as shown in the example below.

[edit protocols bgp group GROUP_AS4]
set import [FILTER_AS4 FILTER_ROUTES]