The Nokia Border Gateway Protocol (BGP) router must be configured to reject inbound route advertisements for any Bogon prefixes.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-283907 | NOKI-RT-000960 | SV-283907r1203970_rule | CCI-001368 | medium |
| Description | ||||
| Accepting route advertisements for Bogon prefixes can result in the local autonomous system (AS) becoming a transit for malicious traffic as it will in turn advertise these prefixes to neighbor autonomous systems. | ||||
| STIG | Date | |||
| Nokia Service Router OS 25.x Router Security Technical Implementation Guide | 2026-06-15 | |||
Details
Check Text (C-283907r1203970_chk)
Review the router configuration to verify it will reject routes of any Bogon prefixes.
Verify the prefix list using the command below:
- show router policy prefix-list "Bogon Prefixes"
prefix 0.0.0.0/8 prefix-length-range 8-32
prefix 10.0.0.0/8 prefix-length-range 8-32
prefix 100.64.0.0/10 prefix-length-range 10-32
prefix 127.0.0.0/8 prefix-length-range 8-32
prefix 169.254.0.0/16 prefix-length-range 16-32
prefix 172.16.0.0/12 prefix-length-range 12-32
prefix 192.0.2.0/24 prefix-length-range 24-32
prefix 192.88.99.0/24 prefix-length-range 24-32
prefix 192.168.0.0/16 prefix-length-range 16-32
prefix 198.18.0.0/15 prefix-length-range 15-32
prefix 198.51.100.0/24 prefix-length-range 24-32
prefix 203.0.113.0/24 prefix-length-range 24-32
prefix 224.0.0.0/4 prefix-length-range 4-32
prefix 240.0.0.0/4 prefix-length-range 4-32
- show router policy prefix-list "Permit Prefix"
prefix 0.0.0.0/0 prefix-length-range 8-32
Verify the policy statement using the command below:
- show router policy "IMPORT-BGP-Prefix"
entry 10
from
prefix-list "Bogon Prefixes"
exit
action drop
exit
exit
entry 20
from
prefix-list "Permit Prefix"
exit
action accept
exit
exit
default-action drop
exit
Verify the policy is applied to the eBGP group using the command below:
- show router bgp group "eBGP" detail | match "Import Policy"
Import Policy : IMPORT-BGP-Prefix
If the router is not configured to reject inbound route advertisements for any Bogon prefixes, this is a finding.
Fix Text (F-88377r1203969_fix)
Ensure all eBGP routers are configured to reject inbound route advertisements for any Bogon prefixes.
Create prefix-lists using the configuration below:
- configure router policy-options
- config>router>policy-options# begin
- config>router>policy-options# prefix-list "Bogon Prefixes"
- config>router>policy-options>prefix-list$ prefix 0.0.0.0/8 prefix-length-range 8-32
- config>router>policy-options>prefix-list$ prefix 10.0.0.0/8 prefix-length-range 8-32
- config>router>policy-options>prefix-list$ prefix 100.64.0.0/10 prefix-length-range 10-32
- config>router>policy-options>prefix-list$ prefix 127.0.0.0/8 prefix-length-range 8-32
- config>router>policy-options>prefix-list$ prefix 169.254.0.0/16 prefix-length-range 16-32
- config>router>policy-options>prefix-list$ prefix 172.16.0.0/12 prefix-length-range 12-32
- config>router>policy-options>prefix-list$ prefix 192.0.2.0/24 prefix-length-range 24-32
- config>router>policy-options>prefix-list$ prefix 192.88.99.0/24 prefix-length-range 24-32
- config>router>policy-options>prefix-list$ prefix 192.168.0.0/16 prefix-length-range 16-32
- config>router>policy-options>prefix-list$ prefix 198.18.0.0/15 prefix-length-range 15-32
- config>router>policy-options>prefix-list$ prefix 198.51.100.0/24 prefix-length-range 24-32
- config>router>policy-options>prefix-list$ prefix 203.0.113.0/24 prefix-length-range 24-32
- config>router>policy-options>prefix-list$ prefix 224.0.0.0/4 prefix-length-range 4-32
- config>router>policy-options>prefix-list$ prefix 240.0.0.0/4 prefix-length-range 4-32
- config>router>policy-options>prefix-list$ exit
- config>router>policy-options# prefix-list "Permit Prefix"
- config>router>policy-options>prefix-list$ prefix 0.0.0.0/0 prefix-length-range 8-32
- config>router>policy-options>prefix-list$ exit
Create a policy statement using the configuration below:
- config>router>policy-options# policy-statement IMPORT-BGP-Prefix
- config>router>policy-options>policy-statement$ entry 10
- config>router>policy-options>policy-statement>entry$ from prefix-list "Bogon Prefixes"
- config>router>policy-options>policy-statement>entry$ action drop
- config>router>policy-options>policy-statement>entry>action$ exit
- config>router>policy-options>policy-statement>entry$ exit
- config>router>policy-options>policy-statement$ entry 20
- config>router>policy-options>policy-statement>entry$ from prefix-list "Permit Prefix"
- config>router>policy-options>policy-statement>entry$ action accept
- config>router>policy-options>policy-statement>entry>action$ exit
- config>router>policy-options>policy-statement>entry$ exit
- config>router>policy-options>policy-statement$ default-action drop
- config>router>policy-options>policy-statement>default-action$ exit
- config>router>policy-options>policy-statement$ exit
- config>router>policy-options# commit
Apply the policy to the eBGP group using the configuration below:
- configure router bgp group "eBGP" import "IMPORT-BGP-Prefix"