The Nokia Border Gateway Protocol (BGP) router must be configured to reject outbound route advertisements for any prefixes belonging to the IP core.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-283870 | NOKI-RT-000520 | SV-283870r1203859_rule | CCI-001097 | medium |
| Description | ||||
| Outbound route advertisements belonging to the core can result in traffic either looping or being black holed, or at a minimum, using a nonoptimized path. | ||||
| STIG | Date | |||
| Nokia Service Router OS 25.x Router Security Technical Implementation Guide | 2026-06-15 | |||
Details
Check Text (C-283870r1203859_chk)
Review the router configuration to verify a filter is defined to block route advertisements for prefixes that belong to the IP core.
Verify a BGP "Export Policy" is applied to the neighbor using the command below:
- show router bgp neighbor 10.50.10.2 detail | match "Export Policy"
Export Policy : Export-Route-EBGP
If the router is not configured to reject outbound route advertisements that belong to the IP core, this is a finding.
Fix Text (F-88340r1203858_fix)
Configure all eBGP routers to filter outbound route advertisements belonging to the IP core, as shown in the example below:
Create a prefix-list:
- configure router policy-options
- config>router>policy-options# begin
- config>router>policy-options# prefix-list "Core-IP-Prefix"
- config>router>policy-options>prefix-list# prefix 192.168.100.10/32
- config>router>policy-options>prefix-list# exit
Create a policy statement:
- config>router>policy-options# policy-statement "Export-Route-EBGP"
- config>router>policy-options>policy-statement# entry 10
- config>router>policy-options>policy-statement>entry# from prefix-list "Core-IP-Prefix"
- config>router>policy-options>policy-statement>entry# action drop
- config>router>policy-options>policy-statement>entry>action# exit
- config>router>policy-options>policy-statement>entry# exit
- config>router>policy-options>policy-statement# exit
- config>router>policy-options# commit
- config>router>policy-options# exit all
Apply the export policy to the BGP:
- configure router bgp group "eBGP-65560" export "Export-Route-EBGP"