DISA STIGS Viewer

The BGP Cisco ACI must be configured to reject outbound route advertisements for any prefixes that do not belong to any customers or the local autonomous system (AS).

Overview

Finding ID Version Rule ID IA Controls Severity
V-272063 CACI-RT-000003 SV-272063r1115719_rule   Medium
Description
Advertisement of routes by an autonomous system for networks that do not belong to any of its customers pulls traffic away from the authorized network. This causes a denial of service (DoS) on the network that allocated the block of addresses and may cause a DoS on the network that is inadvertently advertising it as the originator. It is also possible that a misconfigured or compromised router within the GIG IP core could redistribute IGP routes into BGP, thereby leaking internal routes.
STIG Date
Cisco ACI Router Security Technical Implementation Guide 2025-06-18

Details

Check Text (C-76113r1115717_chk)
Review the ACI configuration to verify it will reject routes belonging to the local AS.

1. Verify a prefix list has been configured containing prefixes belonging to the local AS. In the example below, x.13.1.0/24 is the global address space allocated to the local AS.

ip prefix-list PREFIX_FILTER seq 74 deny x.13.1.0/24 le 32

2. Verify the prefix list has been applied to all external BGP peers as shown in the example below:

router bgp <AS_number> neighbor <peer_IP> prefix-list LOCAL_AS_PREFIX_FILTER out

If the ACI is not configured to reject inbound route advertisements belonging to the local AS, this is a finding.
Fix Text (F-76020r1115718_fix)
Configure the router to reject outbound route advertisements for any prefixes belonging to the local AS. Use a prefix list containing the local AS prefixes and apply it as an outbound filter on the BGP neighbor configuration, as shown in the following examples.

1. Add to the prefix filter list those prefixes belonging to the local autonomous system.

apci1(config)# ip prefix-list LOCAL_AS_PREFIX_FILTER seq 70 deny <local_AS_prefixes>

2. Apply the prefix list filter outbound to each external BGP neighbor.

apci1(config)# router bgp <AS_number> neighbor <peer_IP> prefix-list LOCAL_AS_PREFIX_FILTER out