UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The administrator will restrict BGP connections to known IP addresses of neighbor routers from trusted Autonomous Systems.


Overview

Finding ID Version Rule ID IA Controls Severity
V-3035 NET0410 SV-15298r1_rule ECSC-1 Medium
Description
Advertisement of routes by an autonomous system for networks that do not belong to any of its trusted peers pulls traffic away from the authorized network. This causes DoS on the network that allocated the block of addresses and may cause DoS on the network that is inadvertently advertising it as the originator. It is also possible that a misconfigured or compromised router within the network could re-distribute IGP routes into BGP thereby leaking internal routes.
STIG Date
Perimeter Router Security Technical Implementation Guide Cisco 2015-07-01

Details

Check Text ( C-3490r2_chk )
Review the device configuration to ensure that BGP connections are only from known authorized neighbors in a trusted AS by restricting TCP port 179 to specific IP addresses.

If BGP connections aren't restricted to authorized neighbors by IP address and TCP port 179, this is a finding.
Fix Text (F-3060r2_fix)
Create an ingress ACL to block any unauthorized BGP connection attempts.