STIGQter: STIG Summary: Dell OS10 Switch Router Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Apr 2026:

The Dell OS10 BGP router must be configured to reject outbound route advertisements for any prefixes that do not belong to any customers or the local autonomous system (AS).

DISA Rule

SV-269853r1137897_rule

Vulnerability Number

V-269853

Group Title

SRG-NET-000018-RTR-000005

Rule Version

OS10-RTR-000050

Severity

CAT II

CCI(s)

• CCI-001368 - Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Configure all eBGP routers to filter outbound route advertisements for prefixes that are not allocated to or belong to any customer or the local AS.

Step 1: Configure a prefix list for each customer containing prefixes belonging to each.

OS10(config)# ip prefix-list PREFIX_FILTER_A seq 5 permit 50.10.10.0/24 le 32
OS10(config)# ip prefix-list PREFIX_FILTER_A seq 10 permit 60.10.10.0/24 le 32
OS10(config)# ip prefix-list PREFIX_FILTER_A seq 15 deny 0.0.0.0/0 ge 8

Step 2: Configure the route map referencing the configured prefix list.

OS10(config)# route-map PREFIX_FILTER_A_MAP 50
OS10(config-route-map)# match ip address prefix-list PREFIX_FILTER_A
OS10(config-route-map)# exit

Step 3: Apply the route-map outbound to each external BGP neighbor.

OS10(config)# router bgp 10
OS10(config-router-bgp-10)# neighbor 50.1.1.1
OS10(config-router-neighbor)# address-family ipv4 unicast
OS10(config-router-bgp-neighbor-af)# route-map PREFIX_FILTER_A_MAP out
OS10(config-router-bgp-neighbor-af)# exit
OS10(config-router-neighbor)# exit
OS10(config-router-bgp-10)# exit

Check Contents

This requirement is not applicable for the DODIN Backbone.

Review the router configuration to verify that there is a filter defined to only advertise routes for prefixes that belong to any customers or the local AS.

The prefix filter must be referenced outbound on the appropriate BGP neighbor statements.

Step 1: Verify prefix lists have been configured for each customer containing prefixes that belong to that customer.

OS10# show running-configuration prefix-list
!
...
ip prefix-list PREFIX_FILTER_A seq 5 permit 50.10.10.0/24 le 32
ip prefix-list PREFIX_FILTER_A seq 10 permit 60.10.10.0/24 le 32
ip prefix-list PREFIX_FILTER_A seq 15 deny 0.0.0.0/0 ge 8
...

Step 2: Verify the route map applied to the external neighbors references the configured prefix list shown above.

OS10# show running-configuration route-map
!
route-map PREFIX_FILTER_A_MAP permit 50
match ip address prefix-list PREFIX_FILTER_A

Step 3: Verify the route map applied to the external neighbors references the appropriate route maps shown above.

!
router bgp 10
!
neighbor 50.1.1.1
!
address-family ipv4 unicast
route-map PREFIX_FILTER_A_MAP out

If the router is not configured to reject outbound route advertisements that belong to any customers or the local AS, this is a finding.

Vulnerability Number

V-269853

Documentable

False

Rule Version

OS10-RTR-000050

Severity Override Guidance

This requirement is not applicable for the DODIN Backbone.

Review the router configuration to verify that there is a filter defined to only advertise routes for prefixes that belong to any customers or the local AS.

The prefix filter must be referenced outbound on the appropriate BGP neighbor statements.

Step 1: Verify prefix lists have been configured for each customer containing prefixes that belong to that customer.

OS10# show running-configuration prefix-list
!
...
ip prefix-list PREFIX_FILTER_A seq 5 permit 50.10.10.0/24 le 32
ip prefix-list PREFIX_FILTER_A seq 10 permit 60.10.10.0/24 le 32
ip prefix-list PREFIX_FILTER_A seq 15 deny 0.0.0.0/0 ge 8
...

Step 2: Verify the route map applied to the external neighbors references the configured prefix list shown above.

OS10# show running-configuration route-map
!
route-map PREFIX_FILTER_A_MAP permit 50
match ip address prefix-list PREFIX_FILTER_A

Step 3: Verify the route map applied to the external neighbors references the appropriate route maps shown above.

!
router bgp 10
!
neighbor 50.1.1.1
!
address-family ipv4 unicast
route-map PREFIX_FILTER_A_MAP out

If the router is not configured to reject outbound route advertisements that belong to any customers or the local AS, this is a finding.

Check Content Reference

M

Target Key

5668