STIGQter STIGQter: STIG Summary: VMware NSX 4.x Tier-0 Gateway Router Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 30 Jan 2025:

The NSX Tier-0 Gateway router must be configured to use the Border Gateway Protocol (BGP) maximum prefixes feature to protect against route table flooding and prefix de-aggregation attacks.

DISA Rule

SV-265444r994682_rule

Vulnerability Number

V-265444

Group Title

SRG-NET-000362-RTR-000117

Rule Version

NT0R-4X-000067

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

To set maximum prefixes for BGP neighbors, do the following:

From the NSX Manager web interface, go to Networking >> Connectivity >> Tier-0 Gateways and expand the target Tier-0 gateway.

Expand BGP. Next to "BGP Neighbors", click on the number present to open the dialog, and then select "Edit" on the target BGP Neighbor.

Click "Router Filter", add or edit an existing router filter, enter a number for "Maximum Routes", and then click "Add".

Click "Apply", then click "Save" to finish the configuration.

Check Contents

If the Tier-0 Gateway is not using BGP, this is Not Applicable.

From the NSX Manager web interface, go to Networking >> Connectivity >> Tier-0 Gateways.

For every Tier-0 Gateway with BGP enabled, expand the Tier-0 Gateway.

Expand BGP, click on the number next to "BGP Neighbors", and then view the router filters for each neighbor.

If "Maximum Routes" is not configured, or a route filter does not exist for each BGP neighbor, this is a finding.

Vulnerability Number

V-265444

Documentable

False

Rule Version

NT0R-4X-000067

Severity Override Guidance

If the Tier-0 Gateway is not using BGP, this is Not Applicable.

From the NSX Manager web interface, go to Networking >> Connectivity >> Tier-0 Gateways.

For every Tier-0 Gateway with BGP enabled, expand the Tier-0 Gateway.

Expand BGP, click on the number next to "BGP Neighbors", and then view the router filters for each neighbor.

If "Maximum Routes" is not configured, or a route filter does not exist for each BGP neighbor, this is a finding.

Check Content Reference

M

Target Key

5634