OpenControls Logo

STIG Viewer

STIGViewer Support

The Nokia Border Gateway Protocol (BGP) router must be configured to reject inbound route advertisements for any Bogon prefixes.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-283907NOKI-RT-000960SV-283907r1203970_ruleCCI-001368medium
Description
Accepting route advertisements for Bogon prefixes can result in the local autonomous system (AS) becoming a transit for malicious traffic as it will in turn advertise these prefixes to neighbor autonomous systems.
STIGDate
Nokia Service Router OS 25.x Router Security Technical Implementation Guide2026-06-15

Related Frameworks

1 mapping across 5 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (17) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AST-04Network Diagrams & Data Flow Diagrams (DFDs)
1.00
AST-04.2Control Applicability Boundary Graphical Representation
1.00
CFG-02Secure Baseline Configurations
1.00
CRY-01Use of Cryptographic Controls
1.00
DCH-01Data Protection
1.00
DCH-19Geographic Location of Data
1.00
END-01Endpoint Device Management (EDM)
1.00
END-04Malicious Code Protection (Anti-Malware)
1.00
END-06Endpoint File Integrity Monitoring (FIM)
1.00
IAC-21Least Privilege
1.00

+7 more (top 10 by confidence shown)

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (42) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(7)Role-based Access Control
1.00
AC-4Information Flow Enforcement
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00
AC-6(9)Log Use of Privileged Functions
1.00

+32 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.3
1.00
CCI1 mapping
CCI-001368
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (4) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

DE.CM-09
1.00
ID.AM-03
1.00
PR.DS-10
1.00
PR.IR-01
1.00

Who does this work

18 NICE work roles and 10 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-283907r1203970_chk)

Review the router configuration to verify it will reject routes of any Bogon prefixes. Verify the prefix list using the command below: - show router policy prefix-list "Bogon Prefixes" prefix 0.0.0.0/8 prefix-length-range 8-32 prefix 10.0.0.0/8 prefix-length-range 8-32 prefix 100.64.0.0/10 prefix-length-range 10-32 prefix 127.0.0.0/8 prefix-length-range 8-32 prefix 169.254.0.0/16 prefix-length-range 16-32 prefix 172.16.0.0/12 prefix-length-range 12-32 prefix 192.0.2.0/24 prefix-length-range 24-32 prefix 192.88.99.0/24 prefix-length-range 24-32 prefix 192.168.0.0/16 prefix-length-range 16-32 prefix 198.18.0.0/15 prefix-length-range 15-32 prefix 198.51.100.0/24 prefix-length-range 24-32 prefix 203.0.113.0/24 prefix-length-range 24-32 prefix 224.0.0.0/4 prefix-length-range 4-32 prefix 240.0.0.0/4 prefix-length-range 4-32 - show router policy prefix-list "Permit Prefix" prefix 0.0.0.0/0 prefix-length-range 8-32 Verify the policy statement using the command below: - show router policy "IMPORT-BGP-Prefix" entry 10 from prefix-list "Bogon Prefixes" exit action drop exit exit entry 20 from prefix-list "Permit Prefix" exit action accept exit exit default-action drop exit Verify the policy is applied to the eBGP group using the command below: - show router bgp group "eBGP" detail | match "Import Policy" Import Policy : IMPORT-BGP-Prefix If the router is not configured to reject inbound route advertisements for any Bogon prefixes, this is a finding.

Fix Text (F-88377r1203969_fix)

Ensure all eBGP routers are configured to reject inbound route advertisements for any Bogon prefixes. Create prefix-lists using the configuration below: - configure router policy-options - config>router>policy-options# begin - config>router>policy-options# prefix-list "Bogon Prefixes" - config>router>policy-options>prefix-list$ prefix 0.0.0.0/8 prefix-length-range 8-32 - config>router>policy-options>prefix-list$ prefix 10.0.0.0/8 prefix-length-range 8-32 - config>router>policy-options>prefix-list$ prefix 100.64.0.0/10 prefix-length-range 10-32 - config>router>policy-options>prefix-list$ prefix 127.0.0.0/8 prefix-length-range 8-32 - config>router>policy-options>prefix-list$ prefix 169.254.0.0/16 prefix-length-range 16-32 - config>router>policy-options>prefix-list$ prefix 172.16.0.0/12 prefix-length-range 12-32 - config>router>policy-options>prefix-list$ prefix 192.0.2.0/24 prefix-length-range 24-32 - config>router>policy-options>prefix-list$ prefix 192.88.99.0/24 prefix-length-range 24-32 - config>router>policy-options>prefix-list$ prefix 192.168.0.0/16 prefix-length-range 16-32 - config>router>policy-options>prefix-list$ prefix 198.18.0.0/15 prefix-length-range 15-32 - config>router>policy-options>prefix-list$ prefix 198.51.100.0/24 prefix-length-range 24-32 - config>router>policy-options>prefix-list$ prefix 203.0.113.0/24 prefix-length-range 24-32 - config>router>policy-options>prefix-list$ prefix 224.0.0.0/4 prefix-length-range 4-32 - config>router>policy-options>prefix-list$ prefix 240.0.0.0/4 prefix-length-range 4-32 - config>router>policy-options>prefix-list$ exit - config>router>policy-options# prefix-list "Permit Prefix" - config>router>policy-options>prefix-list$ prefix 0.0.0.0/0 prefix-length-range 8-32 - config>router>policy-options>prefix-list$ exit Create a policy statement using the configuration below: - config>router>policy-options# policy-statement IMPORT-BGP-Prefix - config>router>policy-options>policy-statement$ entry 10 - config>router>policy-options>policy-statement>entry$ from prefix-list "Bogon Prefixes" - config>router>policy-options>policy-statement>entry$ action drop - config>router>policy-options>policy-statement>entry>action$ exit - config>router>policy-options>policy-statement>entry$ exit - config>router>policy-options>policy-statement$ entry 20 - config>router>policy-options>policy-statement>entry$ from prefix-list "Permit Prefix" - config>router>policy-options>policy-statement>entry$ action accept - config>router>policy-options>policy-statement>entry>action$ exit - config>router>policy-options>policy-statement>entry$ exit - config>router>policy-options>policy-statement$ default-action drop - config>router>policy-options>policy-statement>default-action$ exit - config>router>policy-options>policy-statement$ exit - config>router>policy-options# commit Apply the policy to the eBGP group using the configuration below: - configure router bgp group "eBGP" import "IMPORT-BGP-Prefix"