STIGQter STIGQter: STIG Summary: Nokia Service Router OS 25.x Layer 2 Switch Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia layer 2 switch must have Spanning Tree Protocol (STP) loop guard enabled on all nondesignated STP switch ports.

DISA Rule

SV-283681r1204071_rule

Vulnerability Number

V-283681

Group Title

SRG-NET-000362-L2S-000023

Rule Version

NOKI-L2-000090

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the Nokia router VPLS service to disable STP for untrusted ports:

- configure service vpls <service id> sap <sap id> stp shutdown

Check Contents

Review the router configuration to verify BPDU Guard is enabled on the virtual private local area network service (VPLS) for all user-facing or untrusted access switch ports.

BPDUs received will be discarded on service access ports when STP on the VPLS is administratively enabled and the administrative state of STP is disabled.

To verify STP is disabled on the service access ports, use the command below and verify "Stp Admin State" is set to "Down":

- show service id 10 stp

Stp port info

Sap/Sdp/PIP Id Oper- Port- Port- Port- Oper- Link- Active
State Role State Num Edge Type Prot.

1/1/c3/10 Down N/A Discard N/A N/A Pt-pt N/A

If the switch has not disabled STP for untrusted user-facing ports, this is a finding.

Vulnerability Number

V-283681

Documentable

False

Rule Version

NOKI-L2-000090

Severity Override Guidance

Review the router configuration to verify BPDU Guard is enabled on the virtual private local area network service (VPLS) for all user-facing or untrusted access switch ports.

BPDUs received will be discarded on service access ports when STP on the VPLS is administratively enabled and the administrative state of STP is disabled.

To verify STP is disabled on the service access ports, use the command below and verify "Stp Admin State" is set to "Down":

- show service id 10 stp

Stp port info

Sap/Sdp/PIP Id Oper- Port- Port- Port- Oper- Link- Active
State Role State Num Edge Type Prot.

1/1/c3/10 Down N/A Discard N/A N/A Pt-pt N/A

If the switch has not disabled STP for untrusted user-facing ports, this is a finding.

Check Content Reference

M

Target Key

5743