The Nokia Border Gateway Protocol (BGP) router must be configured to limit the prefix size on any inbound route advertisement to /24 or the least significant prefixes issued to the customer.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-283855 | NOKI-RT-000370 | SV-283855r1203814_rule | CCI-002385 | low |
| Description | ||||
| The effects of prefix deaggregation can degrade router performance due to the size of routing tables and can result in black-holing legitimate traffic. Initiated by an attacker or a misconfigured router, prefix deaggregation occurs when the announcement of a large prefix is fragmented into a collection of smaller prefix announcements. | ||||
| STIG | Date | |||
| Nokia Service Router OS 25.x Router Security Technical Implementation Guide | 2026-06-15 | |||
Details
Check Text (C-283855r1203814_chk)
This requirement is not applicable for the DODIN Backbone.
Use the command below to verify the import policy is applied:
- show router bgp neighbor 10.50.10.2 detail | match "Import Policy"
Import Policy : Accept-routes
If the router is not configured to limit the prefix size on any inbound route advertisement to /24 or the least significant prefixes issued to the customer, this is a finding.
Fix Text (F-88325r1203813_fix)
Ensure all eBGP routers are configured to limit the prefix size on any route advertisement to /24 or the least significant prefixes issued to the customer, as shown in the example below:
Create Prefix-List:
- configure router policy-options
- config>router>policy-options# begin
- config>router>policy-options# prefix-list "Filter-Prefix-Length"
- config>router>policy-options>prefix-list# prefix 0.0.0.0/0 prefix-length-range 8-24
Create a policy statement:
- config>router>policy-options# policy-statement "Accept-routes"
- config>router>policy-options>policy-statement# entry 10
- config>router>policy-options>policy-statement>entry# from prefix-list "Filter-Prefix-Length"
- config>router>policy-options>policy-statement>entry# action accept
- config>router>policy-options>policy-statement>entry>action# back
- config>router>policy-options>policy-statement# default-action reject
- config>router>policy-options>policy-statement# back
- config>router>policy-options# commit
- config>router>policy-options# exit all
Apply import policy:
- configure router bgp group "eBGP" import "Accept-routes"