Dell OS10 Switch Router STIG

Dell OS10 Switch Router Security Technical Implementation Guide

The Dell OS10 Switch Router Security Technical Implementation Guide (V1 R2) has 42 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

42STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R2

CurrentPublished Wed Apr 01 2026

The Dell OS10 BGP router must be configured to reject inbound route advertisements for any Bogon prefixes.

Dell OS10 Switch Router Security Technical Implementation Guide

Assessment Title

Rule Text

The Dell OS10 BGP router must be configured to reject inbound route advertisements for any Bogon prefixes.

Description

Discussion Text

Accepting route advertisements for Bogon prefixes can result in the local autonomous system (AS) becoming a transit for malicious traffic as it will in turn advertise these prefixes to neighbor autonomous systems.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-269850

Rule

SV-269850r1137894_rule

Severity

medium

Rule Version

OS10-RTR-000020

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Review the router configuration to verify it will reject routes of any Bogon prefixes.

The prefix filter must be referenced inbound on the appropriate BGP neighbor statements.

Step 1: Verify a prefix list has been configured containing the current Bogon prefixes as shown in the example below.

ip prefix-list BOGON_PREFIX_FILTER seq 5 deny 0.0.0.0/8 le 32
ip prefix-list BOGON_PREFIX_FILTER seq 10 deny 10.0.0.0/8 le 32
ip prefix-list BOGON_PREFIX_FILTER seq 15 deny 100.64.0.0/10 le 32
ip prefix-list BOGON_PREFIX_FILTER seq 20 deny 127.0.0.0/8 le 32
ip prefix-list BOGON_PREFIX_FILTER seq 25 deny 169.254.0.0/16 le 32
ip prefix-list BOGON_PREFIX_FILTER seq 30 deny 172.16.0.0/12 le 32
ip prefix-list BOGON_PREFIX_FILTER seq 35 deny 192.0.2.0/24 le 32
ip prefix-list BOGON_PREFIX_FILTER seq 40 deny 192.88.99.0/24 le 32
ip prefix-list BOGON_PREFIX_FILTER seq 45 deny 192.168.0.0/16 le 32
ip prefix-list BOGON_PREFIX_FILTER seq 50 deny 198.18.0.0/15 le 32
ip prefix-list BOGON_PREFIX_FILTER seq 55 deny 198.51.100.0/24 le 32
ip prefix-list BOGON_PREFIX_FILTER seq 60 deny 203.0.113.0/24 le 32
ip prefix-list BOGON_PREFIX_FILTER seq 65 deny 224.0.0.0/4 le 32
ip prefix-list BOGON_PREFIX_FILTER seq 70 deny 240.0.0.0/4 le 32
ip prefix-list BOGON_PREFIX_FILTER seq 75 permit 0.0.0.0/0 ge 8

Step 2: Verify the route map applied to the external neighbors references the configured Bogon prefix list shown above.

!
route-map PREFIX_FILTER_MAP permit 10
 match ip address prefix-list BOGON_PREFIX_FILTER
 
!
router bgp 10
 !
 template ebgp
  !
  address-family ipv4 unicast
   route-map PREFIX_FILTER_MAP in
 !
 neighbor 123.1.1.10
  !
  address-family ipv4 unicast
   route-map PREFIX_FILTER_MAP in

If the router is not configured to reject inbound route advertisements for any Bogon prefixes, this is a finding.

Implementation Procedure

Fix Text

Ensure all eBGP routers are configured to reject inbound route advertisements for any Bogon prefixes.

Step 1: Configure a prefix list containing the current Bogon prefixes.

OS10(config)# ip prefix-list BOGON_PREFIX_FILTER seq 5 deny 0.0.0.0/8 le 32
OS10(config)# ip prefix-list BOGON_PREFIX_FILTER seq 10 deny 10.0.0.0/8 le 32
OS10(config)# ip prefix-list BOGON_PREFIX_FILTER seq 15 deny 100.64.0.0/10 le 32
OS10(config)# ip prefix-list BOGON_PREFIX_FILTER seq 20 deny 127.0.0.0/8 le 32
OS10(config)# ip prefix-list BOGON_PREFIX_FILTER seq 25 deny 169.254.0.0/16 le 32
OS10(config)# ip prefix-list BOGON_PREFIX_FILTER seq 30 deny 172.16.0.0/12 le 32
OS10(config)# ip prefix-list BOGON_PREFIX_FILTER seq 35 deny 192.0.2.0/24 le 32
OS10(config)# ip prefix-list BOGON_PREFIX_FILTER seq 40 deny 192.88.99.0/24 le 32
OS10(config)# ip prefix-list BOGON_PREFIX_FILTER seq 45 deny 192.168.0.0/16 le 32
OS10(config)# ip prefix-list BOGON_PREFIX_FILTER seq 50 deny 198.18.0.0/15 le 32
OS10(config)# ip prefix-list BOGON_PREFIX_FILTER seq 55 deny 198.51.100.0/24 le 32
OS10(config)# ip prefix-list BOGON_PREFIX_FILTER seq 60 deny 203.0.113.0/24 le 32
OS10(config)# ip prefix-list BOGON_PREFIX_FILTER seq 65 deny 224.0.0.0/4 le 32
OS10(config)# ip prefix-list BOGON_PREFIX_FILTER seq 70 deny 240.0.0.0/4 le 32
OS10(config)# ip prefix-list BOGON_PREFIX_FILTER seq 75 permit 0.0.0.0/0 ge 8

Step 2: Configure the route map referencing the configured Bogon prefix list.

OS10(config)# route-map PREFIX_FILTER_MAP 10
OS10(config-route-map)# match ip address prefix-list BOGON_PREFIX_FILTER
OS10(config-route-map)# exit

Step 3: Apply the route-map inbound to each external BGP neighbor.

OS10(config)# router bgp 10
OS10(config-router-bgp-10)# neighbor 123.1.1.10
OS10(config-router-neighbor)# address-family ipv4 unicast
OS10(config-router-bgp-neighbor-af)# route-map PREFIX_FILTER_MAP in
OS10(config-router-bgp-neighbor-af)# exit
OS10(config-router-neighbor)# exit
OS10(config-router-bgp-10)# template ebgp
OS10(config-router-template)# address-family ipv4 unicast
OS10(config-router-bgp-template-af)# route-map PREFIX_FILTER_MAP in
OS10(config-router-bgp-template-af)# exit
OS10(config-router-template)# exit
OS10(config-router-bgp-10)# exit

STIG check 2 of 42 in the Dell OS10 Switch Router STIG checklist

← Previous · V-269849The Dell OS10 Router must be configured to enforce approved authorizations for controlling the flow of information within the network based on organization-defined information flow control policies.Next · V-269851 →The Dell OS10 BGP router must be configured to reject inbound route advertisements for any prefixes belonging to the local autonomous system (AS).