STIGQter: STIG Summary: Nokia Service Router OS 25.x Layer 2 Switch Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia layer 2 switch must have Internet Group Management Protocol (IGMP) or Multicast Listener Discovery (MLD) snooping configured on all virtual local area networks (VLANs).

DISA Rule

SV-283687r1204134_rule

Vulnerability Number

V-283687

Group Title

SRG-NET-000512-L2S-000002

Rule Version

NOKI-L2-000150

Severity

CAT III

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Configure IGMP or MLD snooping for IPv4 and IPv6 multicast traffic respectively for each VLAN.

The igmp-snooping and mld-snooping can be configured at the VPLS service level or for each access point (VLAN).

For VPLS service-level configuration:

- configure service vpls <service id> igmp-snooping no shutdown
- configure service vpls <service id> mld-snooping no shutdown

For VPLS service access point-level configuration:

- configure service vpls <service id> sap <sap id> igmp-snooping
- configure service vpls <service id> sap <sap id> mld-snooping

Check Contents

Review the switch configuration to verify IGMP or MLD snooping has been configured for IPv4 and IPv6 multicast traffic respectively.

Use the command below for each virtual private local area network service (VPLS) and verify the state of IGMP snooping and MLD snooping:

- show service id 10 igmp-snooping base

IGMP Snooping Base info for service 10

Admin State : Up
Querier : No querier found
SBD service : N/A
Evpn-proxy : Disabled
Port Oper MRtr Pim Send Max Max Max MVR Num
Id Stat Port Port Qrys Grps Srcs Grp From-VPLS Grps
Srcs

sap:1/1/c3/10 Up No No No None None None Local 0

- show service id 10 mld-snooping base

MLD Snooping Base info for service 10

Admin State : Up
Querier : No querier found
SBD service : N/A
Evpn-proxy : Disabled

Port Oper MRtr Send Max MVR Num
Id Stat Port Qrys Grps From-VPLS Grps

sap:1/1/c3/10 Up No No None Local 0

If the switch is not configured to implement IGMP or MLD snooping for each VLAN, this is a finding.

Vulnerability Number

V-283687

Documentable

False

Rule Version

NOKI-L2-000150

Severity Override Guidance

Review the switch configuration to verify IGMP or MLD snooping has been configured for IPv4 and IPv6 multicast traffic respectively.

Use the command below for each virtual private local area network service (VPLS) and verify the state of IGMP snooping and MLD snooping:

- show service id 10 igmp-snooping base

IGMP Snooping Base info for service 10

Admin State : Up
Querier : No querier found
SBD service : N/A
Evpn-proxy : Disabled
Port Oper MRtr Pim Send Max Max Max MVR Num
Id Stat Port Port Qrys Grps Srcs Grp From-VPLS Grps
Srcs

sap:1/1/c3/10 Up No No No None None None Local 0

- show service id 10 mld-snooping base

MLD Snooping Base info for service 10

Admin State : Up
Querier : No querier found
SBD service : N/A
Evpn-proxy : Disabled

Port Oper MRtr Send Max MVR Num
Id Stat Port Qrys Grps From-VPLS Grps

sap:1/1/c3/10 Up No No None Local 0

If the switch is not configured to implement IGMP or MLD snooping for each VLAN, this is a finding.

Check Content Reference

M

Target Key

5743