STIGQter: STIG Summary: Nokia Service Router OS 25.x Layer 2 Switch Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia layer 2 switch must manage excess bandwidth to limit the effects of packet flooding types of denial-of-service (DoS) attacks.

DISA Rule

SV-283679r1204137_rule

Vulnerability Number

V-283679

Group Title

SRG-NET-000193-L2S-000020

Rule Version

NOKI-L2-000040

Severity

CAT II

CCI(s)

CCI-001095 - Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial of service attacks.

Weight

Fix Recommendation

Implement a QoS policy for traffic prioritization and bandwidth reservation. This policy must enforce the traffic priorities specified by the CC/S/As.

Following is one of multiple ways to create a QoS policy.

Configure sap-ingress and/or sap-egress QoS policies:

- configure qos sap-ingress <id> create
- configure qos sap-egress <id> create

For each sap-ingress and sap-egress QoS policy, create as many policers as needed:

- policer <policer id> create
- percent-rate <value> cir <value>
- mbs <value in kbytes>
- cbs <value in kbytes>
- back

Create as many forwarding classes as needed. Forwarding classes can be created using ip-criteria, Differentiated Services Code Point (DSCP) bits in IP header, Precedence bits (IP header), and dot1p bits (Ethernet header). Because this is a layer 2 switch requirement, the example below is using dot1p bits:

- fc <forwarding class> create
- policer <policer id>
- back
- dot1p <dot1p value> fc <forwarding class> priority {low or high}
- exit

For network policy, copy the default network policy 1 into a new network policy and modify parameters as needed:

- configure qos copy network 1 <network policy id>

To list the entries in the network policy created:

- configure qos network <network policy id>
- info detail

Modify the parameters as needed, or use the "no" form of the command to remove them from the configuration.

Configure network QoS queues:

- configure qos network-queue <network queue id> create
- queue <queue id> <queue type> create
- rate <pir percent> cir <cir percent> fir <fir percent>
- mbs <percentage>
- cbs <percentage>

Configure as many queues as needed.

Create as many forwarding classes as needed and assign a queue to them:

- fc <name of forwarding class> create
- multicast-queue <queue id>
- queue <queue id>

QoS policies are applied at the ingress or egress of the access and network ports.

For access interfaces:

- configure service <service id> sap <sap id> ingress qos <sap ingress qos policy id>
- configure service <service id> sap <sap id> egress qos <sap egress qos policy id>

For network interfaces:

- configure router interface <interface name> qos <network qos policy id>

Check Contents

Review the Nokia router configuration to verify QoS has been enabled to ensure sufficient capacity is available for mission-critical traffic such as voice and enforce the traffic priorities specified by the Combatant Commands/Services/Agencies (CC/S/As).

Nokia routers have default QoS policy "1" applied to all ports and service access points (SAPs). Based on the network requirements, another QoS policy should be defined and applied to all ports.

Use the commands below to verify the QoS policies defined and where the policies are applied:

For sap-ingress policies:

- show qos sap-ingress association

Associations

Service-Name : 10
Service-Id : 10 (VPLS) Customer-Id : 1
- SAP : 1/1/c3/10

For sap-egress policies:

- show qos sap-egress association

Associations

Service-Name : 900
Service-Id : 900 (VPLS) Customer-Id : 1
- SAP : lag-4:900

For network policies:

- queue <queue id>
- show qos network <policy id> detail

Interface Association

Interface : to-sr-1-24d-a
IP Addr. : 192.168.1.2/30 Port Id : 1/1/c9/1
IPv6 Addr. : 2001:400:0:3::2/64
Interface : to-sr-1-24d-b
IP Addr. : 192.168.2.1/30 Port Id : 1/1/c10/1

- show qos network-queue association

Port-id : 1/1/c3/1
Port-id : 1/1/c3/2
Port-id : 1/1/c3/3
Port-id : 1/1/c3/4

If the switch is not configured to implement a QoS policy, this is a finding.

The Nokia layer 2 switch must manage excess bandwidth to limit the effects of packet flooding types of denial-of-service (DoS) attacks.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key