The Dell OS10 BGP router must be configured to reject route advertisements from CE routers with an originating autonomous system (AS) in the AS_PATH attribute that does not belong to that customer.

An XCCDF Rule

Description

Verifying the path a route has traversed will ensure that the local AS is not used as a transit network for unauthorized traffic. To ensure that the local AS does not carry any prefixes that do not belong to any customers, all PE routers must be configured to reject routes with an originating AS other than that belonging to the customer.

ID: SV-269855r1051950_rule
Version: OS10-RTR-000100
Severity: Low
References: CCI-001368
Updated: about 2 months ago

Remediation Templates

Configure the router to reject updates from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

Step 1: Configure a prefix list for each customer containing prefixes belonging to each.

OS10(config)# ip as-path access-list AS_PATH_FILTER_CUST1 permit 10.*
OS10(config)# ip as-path access-list AS_PATH_FILTER_CUST1 deny .*OS10(config)# ip as-path access-list AS_PATH_FILTER_CUST2 permit 200
OS10(config)# ip as-path access-list AS_PATH_FILTER_CUST2 deny .*

Step 2: Configure the route map referencing the configured prefix list.

OS10(config)# route-map AS_PATH_FILTER_CUST1_MAP 50
OS10(config-route-map)# match ip address prefix-list AS_PATH_FILTER_CUST1
OS10(config-route-map)# exit
OS10(config)# route-map AS_PATH_FILTER_CUST2_MAP 50
OS10(config-route-map)# match ip address prefix-list AS_PATH_FILTER_CUST2
OS10(config-route-map)# exit

Step 3: Apply the route-map inbound to each external BGP neighbor.

OS10(config)# router bgp 10
OS10(config-router-bgp-10)# neighbor 50.1.1.1
OS10(config-router-neighbor)# address-family ipv4 unicast
OS10(config-router-bgp-neighbor-af)# route-map AS_PATH_FILTER_CUST1_MAP in
OS10(config-router-bgp-neighbor-af)# exit
OS10(config-router-neighbor)# exit
OS10(config-router-bgp-10)# neighbor 60.1.1.1
OS10(config-router-neighbor)# address-family ipv4 unicast
OS10(config-router-bgp-neighbor-af)# route-map AS_PATH_FILTER_CUST2_MAP in
OS10(config-router-bgp-neighbor-af)# exit
OS10(config-router-neighbor)# exit
OS10(config-router-bgp-10)# exit

The Dell OS10 BGP router must be configured to reject route advertisements from CE routers with an originating autonomous system (AS) in the AS_PATH attribute that does not belong to that customer.

Description

Remediation Templates

A Manual Procedure