The Nokia Border Gateway Protocol (BGP) router must be configured to reject inbound route advertisements for any prefixes belonging to the local autonomous system (AS).
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-283908 | NOKI-RT-000970 | SV-283908r1203973_rule | CCI-001368 | medium |
| Description | ||||
| Accepting route advertisements belonging to the local AS can result in traffic looping or being black holed, or at a minimum using a nonoptimized path. | ||||
| STIG | Date | |||
| Nokia Service Router OS 25.x Router Security Technical Implementation Guide | 2026-06-15 | |||
Details
Check Text (C-283908r1203973_chk)
Review the router configuration to verify it will reject routes belonging to the local AS.
Verify the prefix lists using the command below:
- show router policy prefix-list "Deny Prefixes"
prefix 0.0.0.0/8 prefix-length-range 8-32
prefix 10.13.1.0/24 prefix-length-range 24-32
- show router policy prefix-list "Permit Prefix"
prefix 0.0.0.0/0 prefix-length-range 8-32
Verify the policy statement using the command below:
- show router policy "IMPORT-BGP-PREFIX"
entry 10
from
prefix-list "Deny Prefixes"
exit
action drop
exit
exit
entry 20
from
prefix-list "Permit Prefix"
exit
action accept
exit
exit
default-action drop
exit
Verify the policy is applied to the eBGP group using the command below:
- show router bgp group "eBGP" detail | match "Import Policy"
Import Policy : IMPORT-BGP-PREFIX
If the router is not configured to reject inbound route advertisements belonging to the local AS, this is a finding.
Fix Text (F-88378r1203972_fix)
Ensure all eBGP routers are configured to reject inbound route advertisements for any prefixes belonging to the local AS.
Create prefix lists using the configuration below:
- configure router policy-options
- config>router>policy-options# prefix-list "Deny Prefixes"
- config>router>policy-options>prefix-list$ prefix 0.0.0.0/8 prefix-length-range 8-32
- config>router>policy-options>prefix-list$ prefix 10.13.1.0/24 prefix-length-range 24-32
- config>router>policy-options>prefix-list$ exit
- config>router>policy-options# prefix-list "Permit Prefix"
- config>router>policy-options>prefix-list# prefix 0.0.0.0/0 prefix-length-range 8-32
Create a policy statement using the configuration below:
- config>router>policy-options# policy-statement "IMPORT-BGP-Prefix"
- config>router>policy-options>policy-statement# entry 10
- config>router>policy-options>policy-statement>entry$ from prefix-list "Deny Prefixes"
- config>router>policy-options>policy-statement>entry$ action drop
- config>router>policy-options>policy-statement>entry>action$ exit
- config>router>policy-options>policy-statement>entry$ exit
- config>router>policy-options>policy-statement# entry 20
- config>router>policy-options>policy-statement>entry$ from prefix-list "Permit Prefix"
- config>router>policy-options>policy-statement>entry$ action accept
- config>router>policy-options>policy-statement>entry>action$ exit
- config>router>policy-options>policy-statement>entry$ exit
- config>router>policy-options>policy-statement# default-action drop
- config>router>policy-options>policy-statement>default-action# exit
- config>router>policy-options>policy-statement# exit
- config>router>policy-options# commit
- config>router>policy-options# exit all
Apply the policy to the eBGP group using the configuration below:
- configure router bgp group "eBGP" import "IMPORT-BGP-Prefix"