STIGQter: STIG Summary: Dell OS10 Switch Router Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Apr 2026:

The Dell OS10 BGP router must be configured to reject route advertisements from CE routers with an originating autonomous system (AS) in the AS_PATH attribute that does not belong to that customer.

DISA Rule

SV-269855r1195280_rule

Vulnerability Number

V-269855

Group Title

SRG-NET-000018-RTR-000010

Rule Version

OS10-RTR-000100

Severity

CAT III

CCI(s)

• CCI-001368 - Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Configure the router to reject updates from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

Step 1: Configure an as-path access list for each customer containing prefixes belonging to each.

OS10(config)# ip as-path access-list AS_PATH_FILTER_CUST1 permit 10.*
OS10(config)# ip as-path access-list AS_PATH_FILTER_CUST1 deny .*
OS10(config)# ip as-path access-list AS_PATH_FILTER_CUST2 permit 200
OS10(config)# ip as-path access-list AS_PATH_FILTER_CUST2 deny .*

Step 2: Configure the route map referencing the configured as-path access list.

OS10(config)# route-map AS_PATH_FILTER_CUST1_MAP 50
OS10(config-route-map)# match ip address prefix-list AS_PATH_FILTER_CUST1
OS10(config-route-map)# exit
OS10(config)# route-map AS_PATH_FILTER_CUST2_MAP 50
OS10(config-route-map)# match ip address prefix-list AS_PATH_FILTER_CUST2
OS10(config-route-map)# exit

Step 3: Apply the route-map inbound to each external BGP neighbor.

OS10(config)# router bgp 10
OS10(config-router-bgp-10)# neighbor 50.1.1.1
OS10(config-router-neighbor)# address-family ipv4 unicast
OS10(config-router-bgp-neighbor-af)# route-map AS_PATH_FILTER_CUST1_MAP in
OS10(config-router-bgp-neighbor-af)# exit
OS10(config-router-neighbor)# exit
OS10(config-router-bgp-10)# neighbor 60.1.1.1
OS10(config-router-neighbor)# address-family ipv4 unicast
OS10(config-router-bgp-neighbor-af)# route-map AS_PATH_FILTER_CUST2_MAP in
OS10(config-router-bgp-neighbor-af)# exit
OS10(config-router-neighbor)# exit
OS10(config-router-bgp-10)# exit

Check Contents

This requirement is not applicable for the DODIN Backbone.

Review the router configuration to verify the router is configured to deny updates received from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

Step 1: Review router configuration and verify that there is an as-path access-list statement defined to only accept routes from a CE router whose AS did not originate the route.

OS10# show running-configuration as-path
!
...
ip as-path access-list AS_PATH_FILTER_CUST1 permit 10.*
ip as-path access-list AS_PATH_FILTER_CUST1 deny .*
ip as-path access-list AS_PATH_FILTER_CUST2 permit 200
ip as-path access-list AS_PATH_FILTER_CUST2 deny .*
...

Step 2: Verify the route map applied to the external neighbors references the configured as-path access list shown above.

OS10# show running-configuration route-map
!
route-map AS_PATH_FILTER_CUST1_MAP permit 50
match ip address as-path AS_PATH_FILTER_CUST1
!
route-map AS_PATH_FILTER_CUST2_MAP permit 60
match ip address prefix-list AS_PATH_FILTER_CUST2
!

Step 3: Verify the route map applied to the external neighbors references the appropriate route maps shown above.

!
router bgp 10
!
neighbor 50.1.1.1
!
address-family ipv4 unicast
route-map AS_PATH_FILTER_CUST1_MAP in
neighbor 60.1.1.1
!
address-family ipv4 unicast
route-map AS_PATH_FILTER_CUST2_MAP in

If the router is not configured to reject updates from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer, this is a finding.

Vulnerability Number

V-269855

Documentable

False

Rule Version

OS10-RTR-000100

Severity Override Guidance

This requirement is not applicable for the DODIN Backbone.

Review the router configuration to verify the router is configured to deny updates received from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

Step 1: Review router configuration and verify that there is an as-path access-list statement defined to only accept routes from a CE router whose AS did not originate the route.

OS10# show running-configuration as-path
!
...
ip as-path access-list AS_PATH_FILTER_CUST1 permit 10.*
ip as-path access-list AS_PATH_FILTER_CUST1 deny .*
ip as-path access-list AS_PATH_FILTER_CUST2 permit 200
ip as-path access-list AS_PATH_FILTER_CUST2 deny .*
...

Step 2: Verify the route map applied to the external neighbors references the configured as-path access list shown above.

OS10# show running-configuration route-map
!
route-map AS_PATH_FILTER_CUST1_MAP permit 50
match ip address as-path AS_PATH_FILTER_CUST1
!
route-map AS_PATH_FILTER_CUST2_MAP permit 60
match ip address prefix-list AS_PATH_FILTER_CUST2
!

Step 3: Verify the route map applied to the external neighbors references the appropriate route maps shown above.

!
router bgp 10
!
neighbor 50.1.1.1
!
address-family ipv4 unicast
route-map AS_PATH_FILTER_CUST1_MAP in
neighbor 60.1.1.1
!
address-family ipv4 unicast
route-map AS_PATH_FILTER_CUST2_MAP in

If the router is not configured to reject updates from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer, this is a finding.

Check Content Reference

M

Target Key

5668