The RUCKUS ICX BGP router must be configured to reject inbound route advertisements for any Bogon prefixes.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-273570 | SRG-NET-000018-RTR-000002 | RCKS-RTR-000020 | SV-273570r1110906_rule | 2025-06-03 | 1 |
| Description |
|---|
| Accepting route advertisements for Bogon prefixes can result in the local autonomous system (AS) becoming a transit for malicious traffic as it will in turn advertise these prefixes to neighbor autonomous systems. |
| ℹ️ Check |
|---|
| Verify a prefix list exists in the config: SSH@ICX(config)# show ip prefix-lists ip prefix-list PREFIX-FLTR: 1 entries seq 5 deny 0.0.0.0/8 le 32 seq 10 deny 10.0.0.0/8 le 32 ... seq 999 permit 0.0.0.0/0 le 8 Confirm that prefix list is applied to BGP: router bgp neighbor x.x.x.x prefix-list PREFIX-FLTR in If the router is not configured to reject inbound route advertisements for any Bogon prefixes, this is a finding. |
| ✔️ Fix |
|---|
| Configure eBGP routers to reject inbound route advertisements for any Bogon prefixes. 1. Create the desired prefix list. SSH@ICX(config)# ip prefix PREFIX-FLTR seq 5 deny 0.0.0.0/8 le 32 SSH@BowieLab(config)# ip prefix PREFIX-FLTR seq 10 deny 10.0.0.0/8 le 32 ... SSH@BowieLab(config)# ip prefix PREFIX-FLTR seq 999 permit 0.0.0.0/0 le 8 2. Apply to applicable BGP neighbors. router bgp neighbor x.x.x.x prefix-list PREFIX-FLTR in |