300-320 · Question #616
An engineer is configuring BGP as the routing protocol between the CE router of an enterprise and the PE router of the service provider. The interconnection between the CE and PE is direct and is…
The correct answer is B. BGP TTL security check. BGP TTL Security Check (GTSM) protects eBGP sessions from remote spoofing attacks by requiring BGP packets to arrive with a high TTL value, ensuring only directly connected neighbors can establish sessions.
Question
An engineer is configuring BGP as the routing protocol between the CE router of an enterprise and the PE router of the service provider. The interconnection between the CE and PE is direct and is provided through a Metro Ethernet link The engineer notices that attermpts to hijack the established eBGP peering session have been made by a network segment that is not between the eBGP peers. Which BGP mechanism can be deployed to protect the session from this type of attack?
Options
- ABGP outbound route filters
- BBGP TTL security check
- CBGP AS path length limiting
- DBGP communities
How the community answered
(40 responses)- A5% (2)
- B70% (28)
- C8% (3)
- D18% (7)
Why each option
BGP TTL Security Check (GTSM) protects eBGP sessions from remote spoofing attacks by requiring BGP packets to arrive with a high TTL value, ensuring only directly connected neighbors can establish sessions.
BGP outbound route filters control which prefixes are advertised to peers but have no effect on protecting the TCP session itself from hijacking attempts.
GTSM (Generalized TTL Security Mechanism) configures the router to accept BGP TCP packets only if the IP TTL is 255 (or within a configured range), so any attacker not on the directly connected segment will have packets arrive with a decremented TTL and be dropped before the session can be hijacked.
AS path length limiting restricts the number of AS hops in received routes for policy purposes but does not authenticate or protect the BGP TCP session establishment.
BGP communities are route-tagging attributes used for policy decisions on route propagation and have no role in session-level security or authentication.
Concept tested: BGP TTL Security Check (GTSM) session protection
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp/configuration/xe-16/irg-xe-16-book/bgp-ttl-security-check.html
Topics
Community Discussion
No community discussion yet for this question.