STIGQter: STIG Summary: Nokia Service Router OS 25.x Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia Border Gateway Protocol (BGP) router must be configured to reject inbound route advertisements for any prefixes belonging to the local autonomous system (AS).

DISA Rule

SV-283908r1203973_rule

Vulnerability Number

V-283908

Group Title

SRG-NET-000018-RTR-000003

Rule Version

NOKI-RT-000970

Severity

CAT II

CCI(s)

• CCI-001368 - Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Ensure all eBGP routers are configured to reject inbound route advertisements for any prefixes belonging to the local AS.

Create prefix lists using the configuration below:

- configure router policy-options
- config>router>policy-options# prefix-list "Deny Prefixes"
- config>router>policy-options>prefix-list$ prefix 0.0.0.0/8 prefix-length-range 8-32
- config>router>policy-options>prefix-list$ prefix 10.13.1.0/24 prefix-length-range 24-32
- config>router>policy-options>prefix-list$ exit
- config>router>policy-options# prefix-list "Permit Prefix"
- config>router>policy-options>prefix-list# prefix 0.0.0.0/0 prefix-length-range 8-32

Create a policy statement using the configuration below:

- config>router>policy-options# policy-statement "IMPORT-BGP-Prefix"
- config>router>policy-options>policy-statement# entry 10
- config>router>policy-options>policy-statement>entry$ from prefix-list "Deny Prefixes"
- config>router>policy-options>policy-statement>entry$ action drop
- config>router>policy-options>policy-statement>entry>action$ exit
- config>router>policy-options>policy-statement>entry$ exit
- config>router>policy-options>policy-statement# entry 20
- config>router>policy-options>policy-statement>entry$ from prefix-list "Permit Prefix"
- config>router>policy-options>policy-statement>entry$ action accept
- config>router>policy-options>policy-statement>entry>action$ exit
- config>router>policy-options>policy-statement>entry$ exit
- config>router>policy-options>policy-statement# default-action drop
- config>router>policy-options>policy-statement>default-action# exit
- config>router>policy-options>policy-statement# exit
- config>router>policy-options# commit
- config>router>policy-options# exit all

Apply the policy to the eBGP group using the configuration below:

- configure router bgp group "eBGP" import "IMPORT-BGP-Prefix"

Check Contents

Review the router configuration to verify it will reject routes belonging to the local AS.

Verify the prefix lists using the command below:

- show router policy prefix-list "Deny Prefixes"

prefix 0.0.0.0/8 prefix-length-range 8-32
prefix 10.13.1.0/24 prefix-length-range 24-32

- show router policy prefix-list "Permit Prefix"

prefix 0.0.0.0/0 prefix-length-range 8-32

Verify the policy statement using the command below:

- show router policy "IMPORT-BGP-PREFIX"
entry 10
from
prefix-list "Deny Prefixes"
exit
action drop
exit
exit
entry 20
from
prefix-list "Permit Prefix"
exit
action accept
exit
exit
default-action drop
exit

Verify the policy is applied to the eBGP group using the command below:

- show router bgp group "eBGP" detail | match "Import Policy"
Import Policy : IMPORT-BGP-PREFIX

If the router is not configured to reject inbound route advertisements belonging to the local AS, this is a finding.

Vulnerability Number

V-283908

Documentable

False

Rule Version

NOKI-RT-000970

Severity Override Guidance

Review the router configuration to verify it will reject routes belonging to the local AS.

Verify the prefix lists using the command below:

- show router policy prefix-list "Deny Prefixes"

prefix 0.0.0.0/8 prefix-length-range 8-32
prefix 10.13.1.0/24 prefix-length-range 24-32

- show router policy prefix-list "Permit Prefix"

prefix 0.0.0.0/0 prefix-length-range 8-32

Verify the policy statement using the command below:

- show router policy "IMPORT-BGP-PREFIX"
entry 10
from
prefix-list "Deny Prefixes"
exit
action drop
exit
exit
entry 20
from
prefix-list "Permit Prefix"
exit
action accept
exit
exit
default-action drop
exit

Verify the policy is applied to the eBGP group using the command below:

- show router bgp group "eBGP" detail | match "Import Policy"
Import Policy : IMPORT-BGP-PREFIX

If the router is not configured to reject inbound route advertisements belonging to the local AS, this is a finding.

Check Content Reference

M

Target Key

5746