STIGQter: STIG Summary: Cisco ACI Router Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 05 Jan 2026:

The BGP Cisco ACI must be configured to reject inbound route advertisements for any prefixes belonging to the local autonomous system (AS).

DISA Rule

SV-272062r1168387_rule

Vulnerability Number

V-272062

Group Title

SRG-NET-000018-RTR-000003

Rule Version

CACI-RT-000002

Severity

CAT II

CCI(s)

• CCI-001368 - Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Configure the router to reject inbound route advertisements for any prefixes belonging to the local AS. From the relevant BGP peer configuration, create a route-map to filter local AS prefixes. Apply the route-map to the inbound BGP policy. Within the inbound policy, add a prefix filter rule that explicitly rejects any routes with a prefix matching the local AS number.

1. Navigate to Tenants >> {{your_Tenant}} >> Networking >> L3Outs >> {{your_L3Outs}} >> Route Map for import and export route control.
2. Apply that route MAP to the external EPG in the following location: Tenants >> {{your_Tenant}} >> Networking >> L3Outs >> {{your_L3Outs}} >> External EPGs >> Policy >> General >> Route Control Profile.

Note: An alternative to route maps is to use subnets under the External EPG with the correct route controls assigned as discussed in vendor documentation (Reference the L3 out white paper).

Check Contents

Review the switch configuration to verify it will reject routes belonging to the local AS.

1. Verify a prefix list has been configured containing prefixes belonging to the local AS. Navigate to Tenants >> {{your_Tenant}} >> Networking >> L3Outs >> {{your_L3Outs}} >> Route Map for import and export route control.
2. Review the route-map to the inbound BGP policy. Navigate to Tenants >> {{your_Tenant}} >> Networking >> L3Outs >> {{your_L3Outs}} >> External EPGs >> Policy >> General >> Route Control Profile.

If the switch is not configured to reject inbound route advertisements belonging to the local AS, this is a finding.

Vulnerability Number

V-272062

Documentable

False

Rule Version

CACI-RT-000002

Severity Override Guidance

Review the switch configuration to verify it will reject routes belonging to the local AS.

1. Verify a prefix list has been configured containing prefixes belonging to the local AS. Navigate to Tenants >> {{your_Tenant}} >> Networking >> L3Outs >> {{your_L3Outs}} >> Route Map for import and export route control.
2. Review the route-map to the inbound BGP policy. Navigate to Tenants >> {{your_Tenant}} >> Networking >> L3Outs >> {{your_L3Outs}} >> External EPGs >> Policy >> General >> Route Control Profile.

If the switch is not configured to reject inbound route advertisements belonging to the local AS, this is a finding.

Check Content Reference

M

Target Key

5684