STIGQter: STIG Summary: Nokia Service Router OS 25.x Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia Border Gateway Protocol (BGP) router must be configured to reject outbound route advertisements for any prefixes that do not belong to any customers or the local autonomous system (AS).

DISA Rule

SV-283904r1204034_rule

Vulnerability Number

V-283904

Group Title

SRG-NET-000018-RTR-000005

Rule Version

NOKI-RT-000930

Severity

CAT II

CCI(s)

• CCI-001368 - Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Configure all eBGP routers to filter outbound route advertisements for prefixes that are not allocated to or belong to any customer or the local AS.

Create a prefix list using the configuration below:

- config>router>policy-options# begin
- config>router>policy-options# prefix-list "Customer Prefix"
- config>router>policy-options>prefix-list$ prefix 192.168.100.0/24 prefix-length-range 24-32
- config>router>policy-options>prefix-list$ prefix 192.168.200.0/24 prefix-length-range 24-32
- config>router>policy-options>prefix-list$ exit

Create a policy statement using the configuration below:

- config>router>policy-options# policy-statement "Advertise Customer"
- config>router>policy-options>policy-statement$ entry 10
- config>router>policy-options>policy-statement>entry$ from prefix-list "Customer Prefix"
- config>router>policy-options>policy-statement>entry$ action accept
- config>router>policy-options>policy-statement>entry>action$ exit
- router>policy-options>policy-statement$ default-action reject
- config>router>policy-options>policy-statement$ exit
- config>router>policy-options# commit
- config>router>policy-options# exit

Apply the routing policy to the BGP neighbor using the configuration below:

- configure router bgp group "eBGP" export "Advertise Customer"

Check Contents

This requirement is not applicable for the DODIN Backbone.

Review the router configuration to verify a filter is defined to only advertise routes for prefixes that belong to any customers or the local AS.

Use the command below to view the prefix list:

- show router policy prefix-list "Customer Prefix"

prefix 192.168.100.0/24 prefix-length-range 24-32
prefix 192.168.200.0/24 prefix-length-range 24-32

Use the command below to view the policy statement:

- show router policy "Advertise Customer"
entry 10
from
prefix-list "Advertise Customer"
exit
action accept
exit
exit
default-action drop
exit

Use the command below to verify the policy is applied to the eBGP group:

- show router bgp group "eBGP" detail | match "Export Policy"

Export Policy : Advertise Customer

If the router is not configured to reject outbound route advertisements that belong to any customers or the local AS, this is a finding.

Vulnerability Number

V-283904

Documentable

False

Rule Version

NOKI-RT-000930

Severity Override Guidance

This requirement is not applicable for the DODIN Backbone.

Review the router configuration to verify a filter is defined to only advertise routes for prefixes that belong to any customers or the local AS.

Use the command below to view the prefix list:

- show router policy prefix-list "Customer Prefix"

prefix 192.168.100.0/24 prefix-length-range 24-32
prefix 192.168.200.0/24 prefix-length-range 24-32

Use the command below to view the policy statement:

- show router policy "Advertise Customer"
entry 10
from
prefix-list "Advertise Customer"
exit
action accept
exit
exit
default-action drop
exit

Use the command below to verify the policy is applied to the eBGP group:

- show router bgp group "eBGP" detail | match "Export Policy"

Export Policy : Advertise Customer

If the router is not configured to reject outbound route advertisements that belong to any customers or the local AS, this is a finding.

Check Content Reference

M

Target Key

5746