The Dell OS10 BGP router must be configured to reject route advertisements from CE routers with an originating autonomous system (AS) in the AS_PATH attribute that does not belong to that customer.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
low	V-269855	SRG-NET-000018-RTR-000010	OS10-RTR-000100	SV-269855r1051950_rule	2024-12-11	1

Description
Verifying the path a route has traversed will ensure that the local AS is not used as a transit network for unauthorized traffic. To ensure that the local AS does not carry any prefixes that do not belong to any customers, all PE routers must be configured to reject routes with an originating AS other than that belonging to the customer.

ℹ️ Check
This requirement is not applicable for the DODIN Backbone. Review the router configuration to verify the router is configured to deny updates received from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer. Step 1: Review router configuration and verify that there is an as-path access-list statement defined to only accept routes from a CE router whose AS did not originate the route. OS10# show running-configuration as-path ! ... ip as-path access-list AS_PATH_FILTER_CUST1 permit 10.* ip as-path access-list AS_PATH_FILTER_CUST1 deny .* ip as-path access-list AS_PATH_FILTER_CUST2 permit 200 ip as-path access-list AS_PATH_FILTER_CUST2 deny .* ... Step 2: Verify the route map applied to the external neighbors references the configured as-path access list shown above. OS10# show running-configuration route-map ! route-map AS_PATH_FILTER_CUST1_MAP permit 50 match ip address prefix-list AS_PATH_FILTER_CUST1 ! route-map AS_PATH_FILTER_CUST2_MAP permit 60 match ip address prefix-list AS_PATH_FILTER_CUST2 ! Step 3: Verify the route map applied to the external neighbors references the appropriate route maps shown above. ! router bgp 10 ! neighbor 50.1.1.1 ! address-family ipv4 unicast route-map AS_PATH_FILTER_CUST1_MAP in neighbor 60.1.1.1 ! address-family ipv4 unicast route-map AS_PATH_FILTER_CUST2_MAP in If the router is not configured to reject updates from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer, this is a finding.

ℹ️ Check

This requirement is not applicable for the DODIN Backbone. Review the router configuration to verify the router is configured to deny updates received from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer. Step 1: Review router configuration and verify that there is an as-path access-list statement defined to only accept routes from a CE router whose AS did not originate the route. OS10# show running-configuration as-path ! ... ip as-path access-list AS_PATH_FILTER_CUST1 permit 10.* ip as-path access-list AS_PATH_FILTER_CUST1 deny .* ip as-path access-list AS_PATH_FILTER_CUST2 permit 200 ip as-path access-list AS_PATH_FILTER_CUST2 deny .* ... Step 2: Verify the route map applied to the external neighbors references the configured as-path access list shown above. OS10# show running-configuration route-map ! route-map AS_PATH_FILTER_CUST1_MAP permit 50 match ip address prefix-list AS_PATH_FILTER_CUST1 ! route-map AS_PATH_FILTER_CUST2_MAP permit 60 match ip address prefix-list AS_PATH_FILTER_CUST2 ! Step 3: Verify the route map applied to the external neighbors references the appropriate route maps shown above. ! router bgp 10 ! neighbor 50.1.1.1 ! address-family ipv4 unicast route-map AS_PATH_FILTER_CUST1_MAP in neighbor 60.1.1.1 ! address-family ipv4 unicast route-map AS_PATH_FILTER_CUST2_MAP in If the router is not configured to reject updates from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer, this is a finding.

✔️ Fix
Configure the router to reject updates from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer. Step 1: Configure a prefix list for each customer containing prefixes belonging to each. OS10(config)# ip as-path access-list AS_PATH_FILTER_CUST1 permit 10.* OS10(config)# ip as-path access-list AS_PATH_FILTER_CUST1 deny .* OS10(config)# ip as-path access-list AS_PATH_FILTER_CUST2 permit 200 OS10(config)# ip as-path access-list AS_PATH_FILTER_CUST2 deny .* Step 2: Configure the route map referencing the configured prefix list. OS10(config)# route-map AS_PATH_FILTER_CUST1_MAP 50 OS10(config-route-map)# match ip address prefix-list AS_PATH_FILTER_CUST1 OS10(config-route-map)# exit OS10(config)# route-map AS_PATH_FILTER_CUST2_MAP 50 OS10(config-route-map)# match ip address prefix-list AS_PATH_FILTER_CUST2 OS10(config-route-map)# exit Step 3: Apply the route-map inbound to each external BGP neighbor. OS10(config)# router bgp 10 OS10(config-router-bgp-10)# neighbor 50.1.1.1 OS10(config-router-neighbor)# address-family ipv4 unicast OS10(config-router-bgp-neighbor-af)# route-map AS_PATH_FILTER_CUST1_MAP in OS10(config-router-bgp-neighbor-af)# exit OS10(config-router-neighbor)# exit OS10(config-router-bgp-10)# neighbor 60.1.1.1 OS10(config-router-neighbor)# address-family ipv4 unicast OS10(config-router-bgp-neighbor-af)# route-map AS_PATH_FILTER_CUST2_MAP in OS10(config-router-bgp-neighbor-af)# exit OS10(config-router-neighbor)# exit OS10(config-router-bgp-10)# exit

✔️ Fix

Configure the router to reject updates from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer. Step 1: Configure a prefix list for each customer containing prefixes belonging to each. OS10(config)# ip as-path access-list AS_PATH_FILTER_CUST1 permit 10.* OS10(config)# ip as-path access-list AS_PATH_FILTER_CUST1 deny .* OS10(config)# ip as-path access-list AS_PATH_FILTER_CUST2 permit 200 OS10(config)# ip as-path access-list AS_PATH_FILTER_CUST2 deny .* Step 2: Configure the route map referencing the configured prefix list. OS10(config)# route-map AS_PATH_FILTER_CUST1_MAP 50 OS10(config-route-map)# match ip address prefix-list AS_PATH_FILTER_CUST1 OS10(config-route-map)# exit OS10(config)# route-map AS_PATH_FILTER_CUST2_MAP 50 OS10(config-route-map)# match ip address prefix-list AS_PATH_FILTER_CUST2 OS10(config-route-map)# exit Step 3: Apply the route-map inbound to each external BGP neighbor. OS10(config)# router bgp 10 OS10(config-router-bgp-10)# neighbor 50.1.1.1 OS10(config-router-neighbor)# address-family ipv4 unicast OS10(config-router-bgp-neighbor-af)# route-map AS_PATH_FILTER_CUST1_MAP in OS10(config-router-bgp-neighbor-af)# exit OS10(config-router-neighbor)# exit OS10(config-router-bgp-10)# neighbor 60.1.1.1 OS10(config-router-neighbor)# address-family ipv4 unicast OS10(config-router-bgp-neighbor-af)# route-map AS_PATH_FILTER_CUST2_MAP in OS10(config-router-bgp-neighbor-af)# exit OS10(config-router-neighbor)# exit OS10(config-router-bgp-10)# exit