The RUCKUS ICX BGP router must be configured to reject route advertisements from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

Verifying the path a route has traversed will ensure the local AS is not used as a transit network for unauthorized traffic. To ensure that the local AS does not carry any prefixes that do not belong to any customers, all PE routers must be configured to reject routes with an originating AS other than that belonging to the customer.

This requirement is not applicable for the DODIN Backbone.

Review ICX router configuration for AS_PATH filter statements for BGP: ip as-path access-list BGP_filter seq 5 permit ^yy$ ip as-path access-list BGP_filter seq 10 deny .* ! router bgp local-as xx neighbor x.4.4.4 remote-as yy neighbor x.4.4.4 filter-list BGP_filter in !

If the ICX router is not configured to reject updates from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer, this is a finding.

Configure the router to reject updates from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

1. Configure the AS_PATH filter list. ICX(config)# ip as-path access-list BGP_filter seq 5 permit ^yy$ ICX(config)# ip as-path access-list BGP_filter seq 10 deny .*

2. Apply to BGP neighbor. ICX(config)# router bgp ICX(config-bgp-router)# neighbor x.x.x.x filter-list BGP_filter in