The router must only permit BGP connections with known IP addresses of neighbor routers from trusted Autonomous Systems.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-NET-000026-RTR-000030	SRG-NET-000026-RTR-000030	SRG-NET-000026-RTR-000030_rule		Low

Description
Advertisement of routes by an autonomous system for networks that do not belong to any of its trusted peers pulls traffic away from the authorized network. This causes DoS on the network that allocated the block of addresses and may cause DoS on the network that is inadvertently advertising it as the originator. It is also possible that a misconfigured or compromised router within the network could redistribute IGP routes into BGP thereby leaking internal routes.

Description

Advertisement of routes by an autonomous system for networks that do not belong to any of its trusted peers pulls traffic away from the authorized network. This causes DoS on the network that allocated the block of addresses and may cause DoS on the network that is inadvertently advertising it as the originator. It is also possible that a misconfigured or compromised router within the network could redistribute IGP routes into BGP thereby leaking internal routes.

STIG	Date
Router Security Requirements Guide	2013-07-30

Details

Check Text ( C-SRG-NET-000026-RTR-000030_chk )
Review the router configuration to ensure that BGP connections are only from known neighbors in a trusted AS by restricting TCP port 179 to specific IP addresses. If the router configuration does not restrict TCP port 179 to specific IP addresses, this is a finding.

Fix Text (F-SRG-NET-000026-RTR-000030_fix)
Configure the router to ensure BGP connections are only from known neighbors in a trusted AS by restricting TCP port 179 to specific IP addresses.