ARST-RT-000390 - The Arista BGP router must be configured to reject outbound route advertisements for any prefixes belonging to the IP core.

Information

Outbound route advertisements belonging to the core can result in traffic either looping or being black holed, or at a minimum, using a non-optimized path.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Configure all eBGP Arista routers to filter outbound route advertisements belonging to the IP core.

Step 1: Configure an outbound route advertise filter and configure CE Arista MLS to advertise the filter to IP Core PE (100.1.0.128). Also configure an IP prefix list named FILTER_OUT to specify the 172.16.1.0/24 subnet for outbound route advertisements filtering.

LEAF-1A(config)#ip prefix-list FILTER_OUT seq 10 permit 172.16.1.0/24

Step 2: Apply the prefix-list outbound with the BGP neighbor in BGP process.

LEAF-1A(config)#router bgp 65001
LEAF-1A(config-router-bgp)#neighbor 100.1.0.128 remote-as 65200
LEAF-1A(config-router-bgp)#neighbor 100.1.0.128 prefix-list FILTER_OUT out
LEAF-1A(config-router-bgp)# exit

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Arista_MLS_EOS_4-2x_Y24M07_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7a., CAT|II, CCI|CCI-001097, Rule-ID|SV-256020r882402_rule, STIG-ID|ARST-RT-000390, Vuln-ID|V-256020

Plugin: Arista

Control ID: 5320219c713b0c04a4efe7ace8d481836f2beaf251743dca8fb35eea9500323f