nerdexam
Cisco

300-320 · Question #616

An engineer is configuring BGP as the routing protocol between the CE router of an enterprise and the PE router of the service provider. The interconnection between the CE and PE is direct and is…

The correct answer is B. BGP TTL security check. BGP TTL Security Check (GTSM) protects eBGP sessions from remote spoofing attacks by requiring BGP packets to arrive with a high TTL value, ensuring only directly connected neighbors can establish sessions.

Advanced WAN Services

Question

An engineer is configuring BGP as the routing protocol between the CE router of an enterprise and the PE router of the service provider. The interconnection between the CE and PE is direct and is provided through a Metro Ethernet link The engineer notices that attermpts to hijack the established eBGP peering session have been made by a network segment that is not between the eBGP peers. Which BGP mechanism can be deployed to protect the session from this type of attack?

Options

  • ABGP outbound route filters
  • BBGP TTL security check
  • CBGP AS path length limiting
  • DBGP communities

How the community answered

(40 responses)
  • A
    5% (2)
  • B
    70% (28)
  • C
    8% (3)
  • D
    18% (7)

Why each option

BGP TTL Security Check (GTSM) protects eBGP sessions from remote spoofing attacks by requiring BGP packets to arrive with a high TTL value, ensuring only directly connected neighbors can establish sessions.

ABGP outbound route filters

BGP outbound route filters control which prefixes are advertised to peers but have no effect on protecting the TCP session itself from hijacking attempts.

BBGP TTL security checkCorrect

GTSM (Generalized TTL Security Mechanism) configures the router to accept BGP TCP packets only if the IP TTL is 255 (or within a configured range), so any attacker not on the directly connected segment will have packets arrive with a decremented TTL and be dropped before the session can be hijacked.

CBGP AS path length limiting

AS path length limiting restricts the number of AS hops in received routes for policy purposes but does not authenticate or protect the BGP TCP session establishment.

DBGP communities

BGP communities are route-tagging attributes used for policy decisions on route propagation and have no role in session-level security or authentication.

Concept tested: BGP TTL Security Check (GTSM) session protection

Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp/configuration/xe-16/irg-xe-16-book/bgp-ttl-security-check.html

Topics

#BGP TTL security#GTSM#eBGP session protection#BGP hijacking

Community Discussion

No community discussion yet for this question.

Full 300-320 Practice