The RUCKUS ICX BGP router must be configured to reject inbound route advertisements for any Bogon prefixes.

Accepting route advertisements for Bogon prefixes can result in the local autonomous system (AS) becoming a transit for malicious traffic as it will in turn advertise these prefixes to neighbor autonomous systems.

Verify a prefix list exists in the config: SSH@ICX(config)# show ip prefix-lists ip prefix-list PREFIX-FLTR: 1 entries seq 5 deny 0.0.0.0/8 le 32 seq 10 deny 10.0.0.0/8 le 32 ... seq 999 permit 0.0.0.0/0 le 8

Confirm that prefix list is applied to BGP: router bgp neighbor x.x.x.x prefix-list PREFIX-FLTR in

If the router is not configured to reject inbound route advertisements for any Bogon prefixes, this is a finding.

Configure eBGP routers to reject inbound route advertisements for any Bogon prefixes.

1. Create the desired prefix list. SSH@ICX(config)# ip prefix PREFIX-FLTR seq 5 deny 0.0.0.0/8 le 32 SSH@BowieLab(config)# ip prefix PREFIX-FLTR seq 10 deny 10.0.0.0/8 le 32 ... SSH@BowieLab(config)# ip prefix PREFIX-FLTR seq 999 permit 0.0.0.0/0 le 8

2. Apply to applicable BGP neighbors. router bgp neighbor x.x.x.x prefix-list PREFIX-FLTR in