STIGQter: STIG Summary: Nokia Service Router OS 25.x Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia Border Gateway Protocol (BGP) router must be configured to use the maximum prefixes feature to protect against route table flooding and prefix deaggregation attacks.

DISA Rule

SV-283856r1203817_rule

Vulnerability Number

V-283856

Group Title

SRG-NET-000362-RTR-000117

Rule Version

NOKI-RT-000380

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Configure all eBGP routers to use the maximum prefixes feature to protect against route table flooding and prefix deaggregation attacks, as shown in the example below:

- configure router bgp group "eBGP" prefix-limit 500 ipv4
- configure router bgp group "eBGP" prefix-limit 500 ipv6

Check Contents

Review the router configuration to verify the number of received prefixes from each eBGP neighbor is controlled.

Use the command below to verify the prefix limit for IPv4 and IPv6:

- show router bgp neighbor 20.20.20.2 detail | match "Prefix Limit" post-lines 6

Prefix Limits Per Address Family

Family Limit IdleTimeout TH LogOnly PostImport ExcessInact
-------------------------------------------------------------------------------
ipv4 500 forever 90 Disabled Disabled N/A
ipv6 500 forever 90 Disabled Disabled N/A

If the router is not configured to control the number of prefixes received from each peer to protect against route table flooding and prefix deaggregation attacks, this is a finding.

Vulnerability Number

V-283856

Documentable

False

Rule Version

NOKI-RT-000380

Severity Override Guidance

Review the router configuration to verify the number of received prefixes from each eBGP neighbor is controlled.

Use the command below to verify the prefix limit for IPv4 and IPv6:

- show router bgp neighbor 20.20.20.2 detail | match "Prefix Limit" post-lines 6

Prefix Limits Per Address Family

Family Limit IdleTimeout TH LogOnly PostImport ExcessInact
-------------------------------------------------------------------------------
ipv4 500 forever 90 Disabled Disabled N/A
ipv6 500 forever 90 Disabled Disabled N/A

If the router is not configured to control the number of prefixes received from each peer to protect against route table flooding and prefix deaggregation attacks, this is a finding.

Check Content Reference

M

Target Key

5746