STIGQter: STIG Summary: Nokia Service Router OS 25.x Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia Border Gateway Protocol (BGP) router must be configured to reject inbound route advertisements for any Bogon prefixes.

DISA Rule

SV-283907r1203970_rule

Vulnerability Number

V-283907

Group Title

SRG-NET-000018-RTR-000002

Rule Version

NOKI-RT-000960

Severity

CAT II

CCI(s)

• CCI-001368 - Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Ensure all eBGP routers are configured to reject inbound route advertisements for any Bogon prefixes.

Create prefix-lists using the configuration below:

- configure router policy-options
- config>router>policy-options# begin
- config>router>policy-options# prefix-list "Bogon Prefixes"
- config>router>policy-options>prefix-list$ prefix 0.0.0.0/8 prefix-length-range 8-32
- config>router>policy-options>prefix-list$ prefix 10.0.0.0/8 prefix-length-range 8-32
- config>router>policy-options>prefix-list$ prefix 100.64.0.0/10 prefix-length-range 10-32
- config>router>policy-options>prefix-list$ prefix 127.0.0.0/8 prefix-length-range 8-32
- config>router>policy-options>prefix-list$ prefix 169.254.0.0/16 prefix-length-range 16-32
- config>router>policy-options>prefix-list$ prefix 172.16.0.0/12 prefix-length-range 12-32
- config>router>policy-options>prefix-list$ prefix 192.0.2.0/24 prefix-length-range 24-32
- config>router>policy-options>prefix-list$ prefix 192.88.99.0/24 prefix-length-range 24-32
- config>router>policy-options>prefix-list$ prefix 192.168.0.0/16 prefix-length-range 16-32
- config>router>policy-options>prefix-list$ prefix 198.18.0.0/15 prefix-length-range 15-32
- config>router>policy-options>prefix-list$ prefix 198.51.100.0/24 prefix-length-range 24-32
- config>router>policy-options>prefix-list$ prefix 203.0.113.0/24 prefix-length-range 24-32
- config>router>policy-options>prefix-list$ prefix 224.0.0.0/4 prefix-length-range 4-32
- config>router>policy-options>prefix-list$ prefix 240.0.0.0/4 prefix-length-range 4-32
- config>router>policy-options>prefix-list$ exit
- config>router>policy-options# prefix-list "Permit Prefix"
- config>router>policy-options>prefix-list$ prefix 0.0.0.0/0 prefix-length-range 8-32
- config>router>policy-options>prefix-list$ exit

Create a policy statement using the configuration below:

- config>router>policy-options# policy-statement IMPORT-BGP-Prefix
- config>router>policy-options>policy-statement$ entry 10
- config>router>policy-options>policy-statement>entry$ from prefix-list "Bogon Prefixes"
- config>router>policy-options>policy-statement>entry$ action drop
- config>router>policy-options>policy-statement>entry>action$ exit
- config>router>policy-options>policy-statement>entry$ exit
- config>router>policy-options>policy-statement$ entry 20
- config>router>policy-options>policy-statement>entry$ from prefix-list "Permit Prefix"
- config>router>policy-options>policy-statement>entry$ action accept
- config>router>policy-options>policy-statement>entry>action$ exit
- config>router>policy-options>policy-statement>entry$ exit
- config>router>policy-options>policy-statement$ default-action drop
- config>router>policy-options>policy-statement>default-action$ exit
- config>router>policy-options>policy-statement$ exit
- config>router>policy-options# commit

Apply the policy to the eBGP group using the configuration below:

- configure router bgp group "eBGP" import "IMPORT-BGP-Prefix"

Check Contents

Review the router configuration to verify it will reject routes of any Bogon prefixes.

Verify the prefix list using the command below:

- show router policy prefix-list "Bogon Prefixes"

prefix 0.0.0.0/8 prefix-length-range 8-32
prefix 10.0.0.0/8 prefix-length-range 8-32
prefix 100.64.0.0/10 prefix-length-range 10-32
prefix 127.0.0.0/8 prefix-length-range 8-32
prefix 169.254.0.0/16 prefix-length-range 16-32
prefix 172.16.0.0/12 prefix-length-range 12-32
prefix 192.0.2.0/24 prefix-length-range 24-32
prefix 192.88.99.0/24 prefix-length-range 24-32
prefix 192.168.0.0/16 prefix-length-range 16-32
prefix 198.18.0.0/15 prefix-length-range 15-32
prefix 198.51.100.0/24 prefix-length-range 24-32
prefix 203.0.113.0/24 prefix-length-range 24-32
prefix 224.0.0.0/4 prefix-length-range 4-32
prefix 240.0.0.0/4 prefix-length-range 4-32

- show router policy prefix-list "Permit Prefix"

prefix 0.0.0.0/0 prefix-length-range 8-32

Verify the policy statement using the command below:

- show router policy "IMPORT-BGP-Prefix"
entry 10
from
prefix-list "Bogon Prefixes"
exit
action drop
exit
exit
entry 20
from
prefix-list "Permit Prefix"
exit
action accept
exit
exit
default-action drop
exit

Verify the policy is applied to the eBGP group using the command below:

- show router bgp group "eBGP" detail | match "Import Policy"
Import Policy : IMPORT-BGP-Prefix

If the router is not configured to reject inbound route advertisements for any Bogon prefixes, this is a finding.

Vulnerability Number

V-283907

Documentable

False

Rule Version

NOKI-RT-000960

Severity Override Guidance

Review the router configuration to verify it will reject routes of any Bogon prefixes.

Verify the prefix list using the command below:

- show router policy prefix-list "Bogon Prefixes"

prefix 0.0.0.0/8 prefix-length-range 8-32
prefix 10.0.0.0/8 prefix-length-range 8-32
prefix 100.64.0.0/10 prefix-length-range 10-32
prefix 127.0.0.0/8 prefix-length-range 8-32
prefix 169.254.0.0/16 prefix-length-range 16-32
prefix 172.16.0.0/12 prefix-length-range 12-32
prefix 192.0.2.0/24 prefix-length-range 24-32
prefix 192.88.99.0/24 prefix-length-range 24-32
prefix 192.168.0.0/16 prefix-length-range 16-32
prefix 198.18.0.0/15 prefix-length-range 15-32
prefix 198.51.100.0/24 prefix-length-range 24-32
prefix 203.0.113.0/24 prefix-length-range 24-32
prefix 224.0.0.0/4 prefix-length-range 4-32
prefix 240.0.0.0/4 prefix-length-range 4-32

- show router policy prefix-list "Permit Prefix"

prefix 0.0.0.0/0 prefix-length-range 8-32

Verify the policy statement using the command below:

- show router policy "IMPORT-BGP-Prefix"
entry 10
from
prefix-list "Bogon Prefixes"
exit
action drop
exit
exit
entry 20
from
prefix-list "Permit Prefix"
exit
action accept
exit
exit
default-action drop
exit

Verify the policy is applied to the eBGP group using the command below:

- show router bgp group "eBGP" detail | match "Import Policy"
Import Policy : IMPORT-BGP-Prefix

If the router is not configured to reject inbound route advertisements for any Bogon prefixes, this is a finding.

Check Content Reference

M

Target Key

5746