JUEX-RT-000100 - The Juniper router configured for BGP must reject route advertisements from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

Information

Verifying the path a route has traversed will ensure that the local AS is not used as a transit network for unauthorized traffic. To ensure that the local AS does not carry any prefixes that do not belong to any customers, all PE routers must be configured to reject routes with an originating AS other than that belonging to the customer.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Configure the router to reject updates from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

set policy-options policy-statement bgp_originate_65535 term 1 from as-path orig_65535
set policy-options policy-statement bgp_originate_65535 term 1 then accept
set policy-options policy-statement bgp_originate_65535 term 2 then reject
set policy-options as-path orig_65535 '.* 65535'

set protocols bgp group eBGP neighbor <address> import bgp_originate_65535

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Juniper_EX_Switches_Y24M07_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-4(8), CAT|III, CCI|CCI-000032, Rule-ID|SV-253982r945855_rule, STIG-ID|JUEX-RT-000100, Vuln-ID|V-253982

Plugin: Juniper

Control ID: 8dfb703dde4996dc8304100f39c9231998de3d79a121fa95ddbfc97b08393cb4