The Nokia Border Gateway Protocol (BGP) router must be configured to reject inbound route advertisements from a customer edge (CE) router for prefixes that are not allocated to that customer.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-283900NOKI-RT-000890SV-283900r1203949_ruleCCI-001368medium
Description
As a best practice, a service provider should only accept customer prefixes that have been assigned to that customer and any peering autonomous systems. A multihomed customer with BGP speaking routers connected to the internet or other external networks could be breached and used to launch a prefix deaggregation attack. Without ingress route filtering of customers, the effectiveness of such an attack could impact the entire IP core and its customers.
STIGDate
Nokia Service Router OS 25.x Router Security Technical Implementation Guide2026-06-15

Details

Check Text (C-283900r1203949_chk)

Review the BGP router configuration to verify routing policies are defined to only accept routes for prefixes that belong to each specific customer. Verify the prefix-list, policy-statement, and import policy are applied to the eBGP group using the commands below: - show router policy prefix-list "Customer Prefix" prefix 192.168.100.0/24 prefix-length-range 24-32 - show router policy "Import Customer Prefix" entry 10 from prefix-list "Customer Prefix" exit action accept exit exit default-action drop exit - show router bgp group "eBGP" detail | match "Import Policy" Import Policy : Import Customer Prefix If the router is not configured to reject inbound route advertisements from each CE router for prefixes that are not allocated to that customer, this is a finding.

Fix Text (F-88370r1203948_fix)

Configure all eBGP routers to reject inbound route advertisements from a CE router for prefixes that are not allocated to that customer using the example below: Create a prefix list: - configure router policy-options - config>router>policy-options# begin - config>router>policy-options# prefix-list "Customer Prefix" - config>router>policy-options>prefix-list$ prefix 192.168.100.0/24 prefix-length-range 24-32 - config>router>policy-options>prefix-list# exit Create a policy statement: - config>router>policy-options# policy-statement "Import Customer Prefix" - config>router>policy-options>policy-statement$ entry 10 - config>router>policy-options>policy-statement>entry$ from prefix-list "Customer Prefix" - config>router>policy-options>policy-statement>entry$ action accept - config>router>policy-options>policy-statement>entry>action$ exit - config>router>policy-options>policy-statement>entry$ exit - config>router>policy-options>policy-statement$ default-action drop - config>router>policy-options>policy-statement>default-action$ exit - config>router>policy-options>policy-statement$ exit - config>router>policy-options# commit - config>router>policy-options# exit all Apply the import policy to the BGP group: - configure router bgp group "eBGP" import "Import Customer Prefix"