The Juniper BGP router must be configured to reject route advertisements from BGP peers that do not list their autonomous system (AS) number as the first AS in the AS_PATH attribute.

From Juniper Router RTR Security Technical Implementation Guide

Part of SRG-NET-000018-RTR-000006

Associated with: CCI-000032

JUNI-RT-000530_rule The Juniper BGP router must be configured to reject route advertisements from BGP peers that do not list their autonomous system (AS) number as the first AS in the AS_PATH attribute.

Vulnerability discussion

Verifying the path a route has traversed will ensure the IP core is not used as a transit network for unauthorized or possibly even Internet traffic. All autonomous system boundary routers (ASBRs) must ensure updates received from eBGP peers list their AS number as the first AS in the AS_PATH attribute.

Check content

Review the router configuration to verify the router is configured to deny updates received from eBGP peers that do not list their AS number as the first AS in the AS_PATH attribute. Verify a policy has been configured to filter AS_PATH attribute for received BGP advertisements as shown in the example below. policy-options { … … … policy-statement FILTER_AS4 { term ALLOW_AS4 { from as-path PEER_AS4; then accept; } term ELSE_REJECT { then reject; } } … … … as-path PEER_AS4 "^6$"; } Note: the characters “^” and “$” representing the beginning and the end of the expression respectively are optional and are implicitly defined if omitted. Verify that the import policy has been applied to all external BGP peers as shown in the example below. protocols { bgp { group GROUP_AS4 { type external; import [FILTER_AS4 FILTER_ROUTES]; peer-as 4; neighbor x.x.x.x; } If the router is not configured to reject updates from peers that do not list their AS number as the first AS in the AS_PATH attribute, this is a finding.

Fix text

Configure the router to deny updates received from eBGP peers that do not list their AS number as the first AS in the AS_PATH attribute. Configure a policy to filter the AS_PATH as shown in the example below. [edit policy-options] set as-path PEER_AS4 "^4$" set policy-statement FILTER_AS4 term ALLOW_AS4 from as-path PEER_AS4 set policy-statement FILTER_AS4 term ALLOW_AS4 then accept set policy-statement FILTER_AS4 term ELSE_REJECT then reject Apply the import policy as shown in the example below. [edit protocols bgp group GROUP_AS4] set import [FILTER_AS4 FILTER_ROUTES]

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer