STIGQter: STIG Summary: Nokia Service Router OS 25.x Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia Border Gateway Protocol (BGP) router must be configured to limit the prefix size on any inbound route advertisement to /24 or the least significant prefixes issued to the customer.

DISA Rule

SV-283855r1203814_rule

Vulnerability Number

V-283855

Group Title

SRG-NET-000362-RTR-000118

Rule Version

NOKI-RT-000370

Severity

CAT III

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Ensure all eBGP routers are configured to limit the prefix size on any route advertisement to /24 or the least significant prefixes issued to the customer, as shown in the example below:

Create Prefix-List:

- configure router policy-options
- config>router>policy-options# begin
- config>router>policy-options# prefix-list "Filter-Prefix-Length"
- config>router>policy-options>prefix-list# prefix 0.0.0.0/0 prefix-length-range 8-24

Create a policy statement:

- config>router>policy-options# policy-statement "Accept-routes"
- config>router>policy-options>policy-statement# entry 10
- config>router>policy-options>policy-statement>entry# from prefix-list "Filter-Prefix-Length"
- config>router>policy-options>policy-statement>entry# action accept
- config>router>policy-options>policy-statement>entry>action# back
- config>router>policy-options>policy-statement# default-action reject
- config>router>policy-options>policy-statement# back
- config>router>policy-options# commit
- config>router>policy-options# exit all

Apply import policy:

- configure router bgp group "eBGP" import "Accept-routes"

Check Contents

This requirement is not applicable for the DODIN Backbone.

Use the command below to verify the import policy is applied:

- show router bgp neighbor 10.50.10.2 detail | match "Import Policy"
Import Policy : Accept-routes

If the router is not configured to limit the prefix size on any inbound route advertisement to /24 or the least significant prefixes issued to the customer, this is a finding.

Vulnerability Number

V-283855

Documentable

False

Rule Version

NOKI-RT-000370

Severity Override Guidance

This requirement is not applicable for the DODIN Backbone.

Use the command below to verify the import policy is applied:

- show router bgp neighbor 10.50.10.2 detail | match "Import Policy"
Import Policy : Accept-routes

If the router is not configured to limit the prefix size on any inbound route advertisement to /24 or the least significant prefixes issued to the customer, this is a finding.

Check Content Reference

M

Target Key

5746