The Nokia Border Gateway Protocol (BGP) router must be configured to reject inbound route advertisements from a customer edge (CE) router for prefixes that are not allocated to that customer.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-283900 | NOKI-RT-000890 | SV-283900r1203949_rule | CCI-001368 | medium |
| Description | ||||
| As a best practice, a service provider should only accept customer prefixes that have been assigned to that customer and any peering autonomous systems. A multihomed customer with BGP speaking routers connected to the internet or other external networks could be breached and used to launch a prefix deaggregation attack. Without ingress route filtering of customers, the effectiveness of such an attack could impact the entire IP core and its customers. | ||||
| STIG | Date | |||
| Nokia Service Router OS 25.x Router Security Technical Implementation Guide | 2026-06-15 | |||
Details
Check Text (C-283900r1203949_chk)
Review the BGP router configuration to verify routing policies are defined to only accept routes for prefixes that belong to each specific customer.
Verify the prefix-list, policy-statement, and import policy are applied to the eBGP group using the commands below:
- show router policy prefix-list "Customer Prefix"
prefix 192.168.100.0/24 prefix-length-range 24-32
- show router policy "Import Customer Prefix"
entry 10
from
prefix-list "Customer Prefix"
exit
action accept
exit
exit
default-action drop
exit
- show router bgp group "eBGP" detail | match "Import Policy"
Import Policy : Import Customer Prefix
If the router is not configured to reject inbound route advertisements from each CE router for prefixes that are not allocated to that customer, this is a finding.
Fix Text (F-88370r1203948_fix)
Configure all eBGP routers to reject inbound route advertisements from a CE router for prefixes that are not allocated to that customer using the example below:
Create a prefix list:
- configure router policy-options
- config>router>policy-options# begin
- config>router>policy-options# prefix-list "Customer Prefix"
- config>router>policy-options>prefix-list$ prefix 192.168.100.0/24 prefix-length-range 24-32
- config>router>policy-options>prefix-list# exit
Create a policy statement:
- config>router>policy-options# policy-statement "Import Customer Prefix"
- config>router>policy-options>policy-statement$ entry 10
- config>router>policy-options>policy-statement>entry$ from prefix-list "Customer Prefix"
- config>router>policy-options>policy-statement>entry$ action accept
- config>router>policy-options>policy-statement>entry>action$ exit
- config>router>policy-options>policy-statement>entry$ exit
- config>router>policy-options>policy-statement$ default-action drop
- config>router>policy-options>policy-statement>default-action$ exit
- config>router>policy-options>policy-statement$ exit
- config>router>policy-options# commit
- config>router>policy-options# exit all
Apply the import policy to the BGP group:
- configure router bgp group "eBGP" import "Import Customer Prefix"