A service provider peers with an external BGP neighbor across a single-hop link. The security team is concerned about spoofed BGP packets originating from remote, multi-hop sources on the Internet that could be used to attack the router's control plane. They want a lightweight mechanism that validates the packets were sourced from a directly connected peer without relying on ACLs or cryptographic overhead. Which control plane protection mechanism should be configured on the eBGP session?