OpenControls Logo

STIG Viewer

STIGViewer Support

The Cisco BGP router must be configured to reject inbound route advertisements for any Bogon prefixes.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-216597CISC-RT-000490SV-216597r1117236_ruleCCI-001368medium
Description
Accepting route advertisements for Bogon prefixes can result in the local autonomous system (AS) becoming a transit for malicious traffic as it will in turn advertise these prefixes to neighbor autonomous systems.
STIGDate
Cisco IOS Router RTR Security Technical Implementation Guide2025-08-19

Related Frameworks

1 mapping across 5 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (17) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AST-04Network Diagrams & Data Flow Diagrams (DFDs)
1.00
AST-04.2Control Applicability Boundary Graphical Representation
1.00
CFG-02Secure Baseline Configurations
1.00
CRY-01Use of Cryptographic Controls
1.00
DCH-01Data Protection
1.00
DCH-19Geographic Location of Data
1.00
END-01Endpoint Device Management (EDM)
1.00
END-04Malicious Code Protection (Anti-Malware)
1.00
END-06Endpoint File Integrity Monitoring (FIM)
1.00
IAC-21Least Privilege
1.00

+7 more (top 10 by confidence shown)

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (42) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(7)Role-based Access Control
1.00
AC-4Information Flow Enforcement
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00
AC-6(9)Log Use of Privileged Functions
1.00

+32 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.3
1.00
CCI1 mapping
CCI-001368
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (4) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

DE.CM-09
1.00
ID.AM-03
1.00
PR.DS-10
1.00
PR.IR-01
1.00

Who does this work

18 NICE work roles and 10 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-216597r1117236_chk)

This check is Not Applicable for JRSS internal EBGP use. Review the router configuration to verify that it will reject BGP routes for any Bogon prefixes. Step 1: Verify a prefix list has been configured containing the current Bogon prefixes as shown in the example below. ip prefix-list PREFIX_FILTER seq 5 deny 0.0.0.0/8 le 32 ip prefix-list PREFIX_FILTER seq 10 deny 10.0.0.0/8 le 32 ip prefix-list PREFIX_FILTER seq 15 deny 100.64.0.0/10 le 32 ip prefix-list PREFIX_FILTER seq 20 deny 127.0.0.0/8 le 32 ip prefix-list PREFIX_FILTER seq 25 deny 169.254.0.0/16 le 32 ip prefix-list PREFIX_FILTER seq 30 deny 172.16.0.0/12 le 32 ip prefix-list PREFIX_FILTER seq 35 deny 192.0.2.0/24 le 32 ip prefix-list PREFIX_FILTER seq 40 deny 192.88.99.0/24 le 32 ip prefix-list PREFIX_FILTER seq 45 deny 192.168.0.0/16 le 32 ip prefix-list PREFIX_FILTER seq 50 deny 198.18.0.0/15 le 32 ip prefix-list PREFIX_FILTER seq 55 deny 198.51.100.0/24 le 32 ip prefix-list PREFIX_FILTER seq 60 deny 203.0.113.0/24 le 32 ip prefix-list PREFIX_FILTER seq 65 deny 224.0.0.0/4 le 32 ip prefix-list PREFIX_FILTER seq 70 deny 240.0.0.0/4 le 32 ip prefix-list PREFIX_FILTER seq 75 permit 0.0.0.0/0 ge 8 Step 2: Verify that the prefix list has been applied to all external BGP peers as shown in the example below. router bgp xx no synchronization bgp log-neighbor-changes neighbor x.1.1.9 remote-as yy neighbor x.1.1.9 prefix-list PREFIX_FILTER in neighbor x.2.1.7 remote-as zz neighbor x.2.1.7 prefix-list PREFIX_FILTER in Route Map Alternative Verify that the route map applied to the external neighbors references the configured Bogon prefix list shown above. router bgp xx no synchronization bgp log-neighbor-changes neighbor x.1.1.9 remote-as yy neighbor x.1.1.9 route-map FILTER_PREFIX_MAP neighbor x.2.1.7 remote-as zz neighbor x.2.1.7 route-map FILTER_PREFIX_MAP … route-map FILTER_PREFIX_MAP permit 10 match ip address prefix-list PREFIX_FILTER If the router is not configured to reject inbound route advertisements for any Bogon prefixes, this is a finding.

Fix Text (F-17828r287164_fix)

Configure the router to reject inbound route advertisements for any Bogon prefixes. Step 1: Configure a prefix list containing the current Bogon prefixes as shown below. R1(config)#ip prefix-list PREFIX_FILTER deny 0.0.0.0/8 le 32 R1(config)#ip prefix-list PREFIX_FILTER deny 10.0.0.0/8 le 32 R1(config)#ip prefix-list PREFIX_FILTER deny 100.64.0.0/10 le 32 R1(config)#ip prefix-list PREFIX_FILTER deny 127.0.0.0/8 le 32 R1(config)#ip prefix-list PREFIX_FILTER deny 169.254.0.0/16 le 32 R1(config)#ip prefix-list PREFIX_FILTER deny 172.16.0.0/12 le 32 R1(config)#ip prefix-list PREFIX_FILTER deny 192.0.2.0/24 le 32 R1(config)#ip prefix-list PREFIX_FILTER deny 192.88.99.0/24 le 32 R1(config)#ip prefix-list PREFIX_FILTER deny 192.168.0.0/16 le 32 R1(config)#ip prefix-list PREFIX_FILTER deny 198.18.0.0/15 le 32 R1(config)#ip prefix-list PREFIX_FILTER deny 198.51.100.0/24 le 32 R1(config)#ip prefix-list PREFIX_FILTER deny 203.0.113.0/24 le 32 R1(config)#ip prefix-list PREFIX_FILTER deny 224.0.0.0/4 le 32 R1(config)#ip prefix-list PREFIX_FILTER deny 240.0.0.0/4 le 32 R1(config)#ip prefix-list PREFIX_FILTER deny 240.0.0.0/4 le 32 R1(config)#ip prefix-list PREFIX_FILTER permit 0.0.0.0/0 ge 8 Step 2: Apply the prefix list filter inbound to each external BGP neighbor as shown in the example. R1(config)#router bgp xx R1(config-router)#neighbor x.1.1.9 prefix-list PREFIX_FILTER in R1(config-router)#neighbor x.2.1.7 prefix-list PREFIX_FILTER in Route Map Alternative Step 1: Configure the route map referencing the configured prefix list above. R1(config)#route-map FILTER_PREFIX_MAP 10 R1(config-route-map)#match ip address prefix-list PREFIX_FILTER R1(config-route-map)#exit Step 2: Apply the route-map inbound to each external BGP neighbor as shown in the example. R1(config)#router bgp xx R1(config-router)#neighbor x.1.1.9 route-map FILTER_PREFIX_MAP in R1(config-router)#neighbor x.2.1.7 route-map FILTER_PREFIX_MAP in R1(config-router)#end