BGP connections must be restricted to authorized IP addresses of neighbors from trusted Autonomous Systems.

From Perimeter L3 Switch Security Technical Implementation Guide

Part of BGP sessions are not restricted.

SV-3035r3_rule BGP connections must be restricted to authorized IP addresses of neighbors from trusted Autonomous Systems.

Vulnerability discussion

Advertisement of routes by an autonomous system for networks that do not belong to any of its trusted peers pulls traffic away from the authorized network. This causes DoS on the network that allocated the block of addresses and may cause DoS on the network that is inadvertently advertising it as the originator. It is also possible that a misconfigured or compromised router within the network could re-distribute IGP routes into BGP thereby leaking internal routes.

Check content

Review the router configuration and compare it against the network documentation (topology diagrams and peering agreements). Verify that each BGP peering session is configured with the correct IP address and remote Autonomous System Number (ASN). If any BGP peering session is not configured with the correct IP address and remote ASN, this is a finding.

Fix text

Configure each BGP peering session to the specific IP address of the peer router and remote ASN assigned to the organization controlling that peer.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.