The BGP Cisco ACI must be configured to limit the prefix size on any inbound route advertisement to /24 or the least significant prefixes issued to the customer.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-272089 | CACI-RT-000029 | SV-272089r1114282_rule | Low |
| Description |
| The effects of prefix de-aggregation can degrade router performance due to the size of routing tables and also result in black-holing legitimate traffic. Initiated by an attacker or a misconfigured router, prefix de-aggregation occurs when the announcement of a large prefix is fragmented into a collection of smaller prefix announcements. |
| STIG | Date |
| Cisco ACI Router Security Technical Implementation Guide | 2025-06-18 |
Details
| Check Text (C-76139r1063662_chk) |
| Review the configuration of the RP to verify it is rate limiting the number of PIM register messages. tenant <tenant_name> prefix-list ALLOW_SUBNET ip prefix 10.0.0.0/24 permit match-rule filter_rule match prefix allow_subnet tenant <tenant_name> l3extInstP <l3extInstP_name> route-profile FILTER_PROFILE If the router is not configured to limit the prefix size on any inbound route advertisement to /24, or the least significant prefixes issued to the customer, this is a finding. |
| Fix Text (F-76046r1114281_fix) |
| Configure the router to limit the prefix size on any route advertisement to /24 or the least significant prefixes issued to the customer. Create a "match rule" within a "route profile" by specifying a prefix list, which is then applied to the desired L3Out (external routed network) to filter BGP routes based on the prefixes defined in the list. The route profile is applied to a specific L3Out (external routed network) to control which prefixes are advertised or accepted from external networks. 1. Configure a prefix list to reject any prefix that is longer than /24. tenant <tenant_name> prefix-list ALLOW_SUBNET ip prefix 10.0.0.0/24 permit 2. Create a route profile named "filter_profile". tenant <tenant_name> route-profile FILTER_PROFILE match-rule filter_rule match prefix allow_subnet 3. Apply the route profile to an L3Out. tenant <tenant_name> l3extInstP <l3extInstP_name> route-profile FILTER_PROFILE |