STIGQter: STIG Summary: Cisco ACI Router Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 05 Jan 2026:

The BGP Cisco ACI must be configured to limit the prefix size on any inbound route advertisement to /24 or the least significant prefixes issued to the customer.

DISA Rule

SV-272089r1168408_rule

Vulnerability Number

V-272089

Group Title

SRG-NET-000362-RTR-000118

Rule Version

CACI-RT-000029

Severity

CAT III

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Configure the router to limit the prefix size on any route advertisement to /24 or the least significant prefixes issued to the customer.

Create a "match rule" within a "route profile" by specifying a prefix list, to be applied to the desired L3Out (external routed network) to filter BGP routes based on the prefixes defined in the list. The route profile is applied to a specific L3Out (external routed network) to control which prefixes are advertised or accepted from external networks. Refer to the L3 out documentation on setting up route maps or using the import controls on the external EPG subnets on this connection. Ensure on the L3Out the option for Route Control Enforcement Import is checked.

Tenants >> {{your_Tenant}} >> Networking >> L3Out >> {{your_l3out}} >> Policy >> Main >> Route Control Enforcement

Check Contents

Review the configuration of the RP to verify it is rate limiting the number of PIM register messages.

Verify the L3Out option for Route Control Enforcement Import is checked. Navigate to Tenants >> {{your_Tenant}} >> Networking >> L3Out >> {{your_l3out}} >> Policy >> Main >> Route Control Enforcement.

If the router is not configured to limit the prefix size on any inbound route advertisement to /24, or the least significant prefixes issued to the customer, this is a finding.

Vulnerability Number

V-272089

Documentable

False

Rule Version

CACI-RT-000029

Severity Override Guidance

Review the configuration of the RP to verify it is rate limiting the number of PIM register messages.

Verify the L3Out option for Route Control Enforcement Import is checked. Navigate to Tenants >> {{your_Tenant}} >> Networking >> L3Out >> {{your_l3out}} >> Policy >> Main >> Route Control Enforcement.

If the router is not configured to limit the prefix size on any inbound route advertisement to /24, or the least significant prefixes issued to the customer, this is a finding.

Check Content Reference

M

Target Key

5684