STIGQter: STIG Summary: Nokia Service Router OS 25.x Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia Border Gateway Protocol (BGP) router must be configured to reject route advertisements from BGP peers that do not list their autonomous system (AS) number as the first AS in the AS_PATH attribute.

DISA Rule

SV-283827r1203730_rule

Vulnerability Number

V-283827

Group Title

SRG-NET-000018-RTR-000006

Rule Version

NOKI-RT-000090

Severity

CAT III

CCI(s)

• CCI-001368 - Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Configure all ASBRs to deny updates received from eBGP peers that do not list their AS number as the first AS in the AS_PATH attribute:

- configure router bgp group "eBGP"
- config>router>bgp>group# enforce-first-as

Check Contents

Review the router configuration to verify the router is configured to deny updates received from eBGP peers that do not list their AS number as the first AS in the AS_PATH attribute.

Review the router bgp configuration to verify enforce-first-as is not configured, as shown in the example below:

- configure router bgp group "eBGP"
- config>router>bgp>group# info
----------------------------------------------
family ipv4
peer-as 65540
enforce-first-as
neighbor 10.10.30.1
exit
----------------------------------------------

If the router is not configured to reject updates from peers that do not list their AS number as the first AS in the AS_PATH attribute, this is a finding.

Vulnerability Number

V-283827

Documentable

False

Rule Version

NOKI-RT-000090

Severity Override Guidance

Review the router configuration to verify the router is configured to deny updates received from eBGP peers that do not list their AS number as the first AS in the AS_PATH attribute.

Review the router bgp configuration to verify enforce-first-as is not configured, as shown in the example below:

- configure router bgp group "eBGP"
- config>router>bgp>group# info
----------------------------------------------
family ipv4
peer-as 65540
enforce-first-as
neighbor 10.10.30.1
exit
----------------------------------------------

If the router is not configured to reject updates from peers that do not list their AS number as the first AS in the AS_PATH attribute, this is a finding.

Check Content Reference

M

Target Key

5746