STIGQter: STIG Summary: Nokia Service Router OS 25.x Layer 2 Switch Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia layer 2 switch must enable Ethernet Connectivity Fault Management (ETH-CFM) to protect against one-way connections.

DISA Rule

SV-283689r1204095_rule

Vulnerability Number

V-283689

Group Title

SRG-NET-000512-L2S-000004

Rule Version

NOKI-L2-000170

Severity

CAT II

CCI(s)

CCI-000366 - Implement the security configuration settings.

Weight

Fix Recommendation

Configure the ETH-CFM maintenance domain and bind the Maintenance Endpoint (MEP) to the SAP to be monitored. Use the CCMs to detect possible unidirectional issues.

Configure ETH-CFM domain information:

- configure eth-cfm domain <domain id> format none level <level>
- association 1 format icc-based name <name>
- bridge-identifier bridge-name <vpls service name>
- back
- remote-mepid <mep id>

Apply to the SAP within VPLS:

- configure service vpls <id>
- sap <sap id> eth-cfm mep <mep id> domain <domain id> association <index>
- ccm-enable
- no shutdown

Check Contents

Verify the ETH-CFM configuration for the service access point (SAP) in the virtual private local area network service (VPLS) appears as shown in the example below.

- show service id 10 sap 1/1/c3/10 detail

Eth-Cfm MEP Configuration Information

Md-index : 3 Direction : Down
Ma-index : 1 Admin : Enabled
MepId : 10 CCM-Enable : Enabled

If ETH-CFM is not configured to protect against one-way connections, this is a finding.

The Nokia layer 2 switch must enable Ethernet Connectivity Fault Management (ETH-CFM) to protect against one-way connections.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key