The Arista BGP router must be configured to reject route advertisements from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.
An XCCDF Rule
Description
<VulnDiscussion>Verifying the path a route has traversed will ensure that the local AS is not used as a transit network for unauthorized traffic. To ensure that the local AS does not carry any prefixes that do not belong to any customers, all PE routers must be configured to reject routes with an originating AS other than that belonging to the customer.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-255996r882330_rule
- Severity
- Low
- References
- Updated
Remediation - Manual Procedure
Configure the Arista router to reject updates from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.
Step 1: Configure the as-path access-list to filter the updates from the CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.
router (config) # ip as-path regex-mode asn
router (config) # ip as-path access-list NEIGHBOR_PATH permit ^35121$ any