STIGQter: STIG Summary: Nokia Service Router OS 25.x Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia Border Gateway Protocol (BGP) router must be configured to reject route advertisements from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

DISA Rule

SV-283828r1203733_rule

Vulnerability Number

V-283828

Group Title

SRG-NET-000018-RTR-000010

Rule Version

NOKI-RT-000100

Severity

CAT III

CCI(s)

• CCI-001368 - Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Configure the router to reject updates from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

Configure the as-path, as shown in the example below:

- configure router policy-options
- config>router>policy-options# begin
- config>router>policy-options# as-path "accept-65560"
- config>router>policy-options>as-path# expression "^65560$"
- config>router>policy-options>as-path#
- config>router>policy-options>as-path# exit

Configure the policy statement, as shown in the example below:

- config>router>policy-options# policy-statement "Accept-routes"
- config>router>policy-options>policy-statement# entry 10
- config>router>policy-options>policy-statement>entry# from protocol bgp
- config>router>policy-options>policy-statement>entry# from as-path "accept-65560"
- config>router>policy-options>policy-statement>entry# action accept
- config>router>policy-options>policy-statement>entry>action# exit
- config>router>policy-options>policy-statement>entry# exit
- config>router>policy-options>policy-statement# default-action drop
- config>router>policy-options>policy-statement>default-action# exit
- config>router>policy-options>policy-statement# exit
- config>router>policy-options# commit
- config>router>policy-options# exit all

Apply the import policy, as shown in the example below:

- configure router bgp group "eBGP-65560" import "Accept-routes"

Check Contents

This requirement is not applicable for the DODIN Backbone.

Review the router configuration to verify the router is configured to deny updates received from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

Review the router policy as-path and policy statement, as shown in the example below:

- show router policy as-path "accept-65560"
as-path "accept-65560" expression "^65560$"

- show router policy "Accept-routes"
entry 10
from
protocol bgp
as-path "accept-65560"
exit
action accept
exit
exit
default-action drop
exit

Review the import policy, as shown in the example below:

- show router bgp neighbor 10.50.10.2 detail | match "Import Policy"
Import Policy : Accept-routes

If the router is not configured to reject updates from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer, this is a finding.

Vulnerability Number

V-283828

Documentable

False

Rule Version

NOKI-RT-000100

Severity Override Guidance

This requirement is not applicable for the DODIN Backbone.

Review the router configuration to verify the router is configured to deny updates received from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer.

Review the router policy as-path and policy statement, as shown in the example below:

- show router policy as-path "accept-65560"
as-path "accept-65560" expression "^65560$"

- show router policy "Accept-routes"
entry 10
from
protocol bgp
as-path "accept-65560"
exit
action accept
exit
exit
default-action drop
exit

Review the import policy, as shown in the example below:

- show router bgp neighbor 10.50.10.2 detail | match "Import Policy"
Import Policy : Accept-routes

If the router is not configured to reject updates from CE routers with an originating AS in the AS_PATH attribute that does not belong to that customer, this is a finding.

Check Content Reference

M

Target Key

5746