STIGQter: STIG Summary: Nokia Service Router OS 25.x Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia Border Gateway Protocol (BGP) router must be configured to reject outbound route advertisements for any prefixes belonging to the IP core.

DISA Rule

SV-283870r1203859_rule

Vulnerability Number

V-283870

Group Title

SRG-NET-000205-RTR-000006

Rule Version

NOKI-RT-000520

Severity

CAT II

CCI(s)

• CCI-001097 - Monitor and control communications at the external managed interfaces to the system and at key managed interfaces within the system.

Weight

10

Fix Recommendation

Configure all eBGP routers to filter outbound route advertisements belonging to the IP core, as shown in the example below:

Create a prefix-list:

- configure router policy-options
- config>router>policy-options# begin
- config>router>policy-options# prefix-list "Core-IP-Prefix"
- config>router>policy-options>prefix-list# prefix 192.168.100.10/32
- config>router>policy-options>prefix-list# exit

Create a policy statement:

- config>router>policy-options# policy-statement "Export-Route-EBGP"
- config>router>policy-options>policy-statement# entry 10
- config>router>policy-options>policy-statement>entry# from prefix-list "Core-IP-Prefix"
- config>router>policy-options>policy-statement>entry# action drop
- config>router>policy-options>policy-statement>entry>action# exit
- config>router>policy-options>policy-statement>entry# exit
- config>router>policy-options>policy-statement# exit
- config>router>policy-options# commit
- config>router>policy-options# exit all

Apply the export policy to the BGP:

- configure router bgp group "eBGP-65560" export "Export-Route-EBGP"

Check Contents

Review the router configuration to verify a filter is defined to block route advertisements for prefixes that belong to the IP core.

Verify a BGP "Export Policy" is applied to the neighbor using the command below:

- show router bgp neighbor 10.50.10.2 detail | match "Export Policy"
Export Policy : Export-Route-EBGP

If the router is not configured to reject outbound route advertisements that belong to the IP core, this is a finding.

Vulnerability Number

V-283870

Documentable

False

Rule Version

NOKI-RT-000520

Severity Override Guidance

Review the router configuration to verify a filter is defined to block route advertisements for prefixes that belong to the IP core.

Verify a BGP "Export Policy" is applied to the neighbor using the command below:

- show router bgp neighbor 10.50.10.2 detail | match "Export Policy"
Export Policy : Export-Route-EBGP

If the router is not configured to reject outbound route advertisements that belong to the IP core, this is a finding.

Check Content Reference

M

Target Key

5746