STIGQter: STIG Summary: Nokia Service Router OS 25.x Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia Border Gateway Protocol (BGP) router must be configured to reject inbound route advertisements from a customer edge (CE) router for prefixes that are not allocated to that customer.

DISA Rule

SV-283900r1203949_rule

Vulnerability Number

V-283900

Group Title

SRG-NET-000018-RTR-000004

Rule Version

NOKI-RT-000890

Severity

CAT II

CCI(s)

• CCI-001368 - Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Configure all eBGP routers to reject inbound route advertisements from a CE router for prefixes that are not allocated to that customer using the example below:

Create a prefix list:

- configure router policy-options
- config>router>policy-options# begin
- config>router>policy-options# prefix-list "Customer Prefix"
- config>router>policy-options>prefix-list$ prefix 192.168.100.0/24 prefix-length-range 24-32
- config>router>policy-options>prefix-list# exit

Create a policy statement:

- config>router>policy-options# policy-statement "Import Customer Prefix"
- config>router>policy-options>policy-statement$ entry 10
- config>router>policy-options>policy-statement>entry$ from prefix-list "Customer Prefix"
- config>router>policy-options>policy-statement>entry$ action accept
- config>router>policy-options>policy-statement>entry>action$ exit
- config>router>policy-options>policy-statement>entry$ exit
- config>router>policy-options>policy-statement$ default-action drop
- config>router>policy-options>policy-statement>default-action$ exit
- config>router>policy-options>policy-statement$ exit
- config>router>policy-options# commit
- config>router>policy-options# exit all

Apply the import policy to the BGP group:

- configure router bgp group "eBGP" import "Import Customer Prefix"

Check Contents

Review the BGP router configuration to verify routing policies are defined to only accept routes for prefixes that belong to each specific customer.

Verify the prefix-list, policy-statement, and import policy are applied to the eBGP group using the commands below:

- show router policy prefix-list "Customer Prefix"

prefix 192.168.100.0/24 prefix-length-range 24-32

- show router policy "Import Customer Prefix"

entry 10
from
prefix-list "Customer Prefix"
exit
action accept
exit
exit
default-action drop
exit

- show router bgp group "eBGP" detail | match "Import Policy"

Import Policy : Import Customer Prefix

If the router is not configured to reject inbound route advertisements from each CE router for prefixes that are not allocated to that customer, this is a finding.

Vulnerability Number

V-283900

Documentable

False

Rule Version

NOKI-RT-000890

Severity Override Guidance

Review the BGP router configuration to verify routing policies are defined to only accept routes for prefixes that belong to each specific customer.

Verify the prefix-list, policy-statement, and import policy are applied to the eBGP group using the commands below:

- show router policy prefix-list "Customer Prefix"

prefix 192.168.100.0/24 prefix-length-range 24-32

- show router policy "Import Customer Prefix"

entry 10
from
prefix-list "Customer Prefix"
exit
action accept
exit
exit
default-action drop
exit

- show router bgp group "eBGP" detail | match "Import Policy"

Import Policy : Import Customer Prefix

If the router is not configured to reject inbound route advertisements from each CE router for prefixes that are not allocated to that customer, this is a finding.

Check Content Reference

M

Target Key

5746