OpenControls Logo

STIG Viewer

STIGViewer Support

The Dell OS10 BGP router must be configured to reject inbound route advertisements for any Bogon prefixes.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-269850OS10-RTR-000020SV-269850r1051935_ruleCCI-001368medium
Description
Accepting route advertisements for Bogon prefixes can result in the local autonomous system (AS) becoming a transit for malicious traffic as it will in turn advertise these prefixes to neighbor autonomous systems.
STIGDate
Dell OS10 Switch Router Security Technical Implementation Guide2024-12-11

Related Frameworks

1 mapping across 5 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (17) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AST-04Network Diagrams & Data Flow Diagrams (DFDs)
1.00
AST-04.2Control Applicability Boundary Graphical Representation
1.00
CFG-02Secure Baseline Configurations
1.00
CRY-01Use of Cryptographic Controls
1.00
DCH-01Data Protection
1.00
DCH-19Geographic Location of Data
1.00
END-01Endpoint Device Management (EDM)
1.00
END-04Malicious Code Protection (Anti-Malware)
1.00
END-06Endpoint File Integrity Monitoring (FIM)
1.00
IAC-21Least Privilege
1.00

+7 more (top 10 by confidence shown)

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (42) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(7)Role-based Access Control
1.00
AC-4Information Flow Enforcement
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00
AC-6(9)Log Use of Privileged Functions
1.00

+32 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.3
1.00
CCI1 mapping
CCI-001368
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (4) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

DE.CM-09
1.00
ID.AM-03
1.00
PR.DS-10
1.00
PR.IR-01
1.00

Who does this work

18 NICE work roles and 10 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-269850r1051935_chk)

Review the router configuration to verify it will reject routes of any Bogon prefixes. The prefix filter must be referenced inbound on the appropriate BGP neighbor statements. Step 1: Verify a prefix list has been configured containing the current Bogon prefixes as shown in the example below. ip prefix-list BOGON_PREFIX_FILTER seq 5 deny 0.0.0.0/8 le 32 ip prefix-list BOGON_PREFIX_FILTER seq 10 deny 10.0.0.0/8 le 32 ip prefix-list BOGON_PREFIX_FILTER seq 15 deny 100.64.0.0/10 le 32 ip prefix-list BOGON_PREFIX_FILTER seq 20 deny 127.0.0.0/8 le 32 ip prefix-list BOGON_PREFIX_FILTER seq 25 deny 169.254.0.0/16 le 32 ip prefix-list BOGON_PREFIX_FILTER seq 30 deny 172.16.0.0/12 le 32 ip prefix-list BOGON_PREFIX_FILTER seq 35 deny 192.0.2.0/24 le 32 ip prefix-list BOGON_PREFIX_FILTER seq 40 deny 192.88.99.0/24 le 32 ip prefix-list BOGON_PREFIX_FILTER seq 45 deny 192.168.0.0/16 le 32 ip prefix-list BOGON_PREFIX_FILTER seq 50 deny 198.18.0.0/15 le 32 ip prefix-list BOGON_PREFIX_FILTER seq 55 deny 198.51.100.0/24 le 32 ip prefix-list BOGON_PREFIX_FILTER seq 60 deny 203.0.113.0/24 le 32 ip prefix-list BOGON_PREFIX_FILTER seq 65 deny 224.0.0.0/4 le 32 ip prefix-list BOGON_PREFIX_FILTER seq 70 deny 240.0.0.0/4 le 32 ip prefix-list BOGON_PREFIX_FILTER seq 75 permit 0.0.0.0/0 ge 8 Step 2: Verify the route map applied to the external neighbors references the configured Bogon prefix list shown above. ! route-map PREFIX_FILTER_MAP permit 10 match ip address prefix-list BOGON_PREFIX_FILTER ! router bgp 10 ! template ebgp ! address-family ipv4 unicast route-map PREFIX_FILTER_MAP in ! neighbor 123.1.1.10 ! address-family ipv4 unicast route-map PREFIX_FILTER_MAP in If the router is not configured to reject inbound route advertisements for any Bogon prefixes, this is a finding.

Fix Text (F-73784r1051934_fix)

Ensure all eBGP routers are configured to reject inbound route advertisements for any Bogon prefixes. Step 1: Configure a prefix list containing the current Bogon prefixes. OS10(config)# ip prefix-list BOGON_PREFIX_FILTER seq 5 deny 0.0.0.0/8 le 32 OS10(config)# ip prefix-list BOGON_PREFIX_FILTER seq 10 deny 10.0.0.0/8 le 32 OS10(config)# ip prefix-list BOGON_PREFIX_FILTER seq 15 deny 100.64.0.0/10 le 32 OS10(config)# ip prefix-list BOGON_PREFIX_FILTER seq 20 deny 127.0.0.0/8 le 32 OS10(config)# ip prefix-list BOGON_PREFIX_FILTER seq 25 deny 169.254.0.0/16 le 32 OS10(config)# ip prefix-list BOGON_PREFIX_FILTER seq 30 deny 172.16.0.0/12 le 32 OS10(config)# ip prefix-list BOGON_PREFIX_FILTER seq 35 deny 192.0.2.0/24 le 32 OS10(config)# ip prefix-list BOGON_PREFIX_FILTER seq 40 deny 192.88.99.0/24 le 32 OS10(config)# ip prefix-list BOGON_PREFIX_FILTER seq 45 deny 192.168.0.0/16 le 32 OS10(config)# ip prefix-list BOGON_PREFIX_FILTER seq 50 deny 198.18.0.0/15 le 32 OS10(config)# ip prefix-list BOGON_PREFIX_FILTER seq 55 deny 198.51.100.0/24 le 32 OS10(config)# ip prefix-list BOGON_PREFIX_FILTER seq 60 deny 203.0.113.0/24 le 32 OS10(config)# ip prefix-list BOGON_PREFIX_FILTER seq 65 deny 224.0.0.0/4 le 32 OS10(config)# ip prefix-list BOGON_PREFIX_FILTER seq 70 deny 240.0.0.0/4 le 32 OS10(config)# ip prefix-list BOGON_PREFIX_FILTER seq 75 permit 0.0.0.0/0 ge 8 Step 2: Configure the route map referencing the configured Bogon prefix list. OS10(config)# route-map PREFIX_FILTER_MAP 10 OS10(config-route-map)# match ip address prefix-list BOGON_PREFIX_FILTER OS10(config-route-map)# exit Step 3: Apply the route-map inbound to each external BGP neighbor. OS10(config)# router bgp 10 OS10(config-router-bgp-10)# neighbor 123.1.1.10 OS10(config-router-neighbor)# address-family ipv4 unicast OS10(config-router-bgp-neighbor-af)# route-map PREFIX_FILTER_MAP in OS10(config-router-bgp-neighbor-af)# exit OS10(config-router-neighbor)# exit OS10(config-router-bgp-10)# template ebgp OS10(config-router-template)# address-family ipv4 unicast OS10(config-router-bgp-template-af)# route-map PREFIX_FILTER_MAP in OS10(config-router-bgp-template-af)# exit OS10(config-router-template)# exit OS10(config-router-bgp-10)# exit