The BGP router must be configured to reject route advertisements from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-92243	SRG-NET-000018-RTR-000010	SV-102345r2_rule		Low

Description
Verifying the path a route has traversed will ensure that the local AS is not used as a transit network for unauthorized traffic. To ensure that the local AS does not carry any prefixes that do not belong to any customers, all PE routers must be configured to reject routes with an originating AS other than that belonging to the customer.

STIG	Date
Router Security Requirements Guide	2020-06-30

Details

Check Text ( C-91409r4_chk )
This requirement is not applicable for the DODIN Backbone. Review the router configuration to verify the router is configured to deny updates received from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer. Step 1: Review router configuration and verify that there is an as-path access-list statement defined to only accept routes from a CE router whose AS did not originate the route. Step 2: Verify that the as-path access list is referenced by the filter-list inbound for the appropriate BGP neighbors. If the router is not configured to reject updates from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer, this is a finding.

Check Text ( C-91409r4_chk )

This requirement is not applicable for the DODIN Backbone.

Review the router configuration to verify the router is configured to deny updates received from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

Step 1: Review router configuration and verify that there is an as-path access-list statement defined to only accept routes from a CE router whose AS did not originate the route.

Step 2: Verify that the as-path access list is referenced by the filter-list inbound for the appropriate BGP neighbors.

If the router is not configured to reject updates from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer, this is a finding.

Fix Text (F-98451r2_fix)
Configure the router to reject updates from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.