Rotate your device back to portrait to use STIG Vault.

Home
Dashboard
Search
STIG Repository
STIG Compare
SCAP Repository
SCAP Compare
CCIs
Guides
Contact

Appearance

Palette

Router Security Requirements Guide

The Router Security Requirements Guide (V4 R1) has 105 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

105STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V4 · R1

CurrentPublished Fri Jan 22 2021

The BGP router must be configured to reject inbound route advertisements for any prefixes belonging to the local autonomous system (AS).

Router Security Requirements Guide

Assessment Title

Rule Text

Description

Discussion Text

Accepting route advertisements belonging to the local AS can result in traffic looping or being black holed, or at a minimum using a non-optimized path.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-207099

Rule

SV-207099r604135_rule

Severity

medium

Rule Version

SRG-NET-000018-RTR-000003

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Review the router configuration to verify that it will reject routes belonging to the local AS.

The prefix filter must be referenced inbound on the appropriate BGP neighbor statements.

If the router is not configured to reject inbound route advertisements belonging to the local AS, this is a finding.

Implementation Procedure

Fix Text

Ensure all eBGP routers are configured to reject inbound route advertisements for any prefixes belonging to the local AS.

STIG check 3 of 105 in the Router Security Requirements Guide checklist

← Previous · V-207098The BGP router must be configured to reject inbound route advertisements for any Bogon prefixes.Next · V-207100 →The BGP router must be configured to reject inbound route advertisements from a customer edge (CE) router for prefixes that are not allocated to that customer.