STIGQter STIGQter: STIG Summary: Nokia Service Router OS 25.x Layer 2 Switch Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia layer 2 switch must not have the default virtual local area network (VLAN) assigned to any host-facing switch ports.

DISA Rule

SV-283691r1204101_rule

Vulnerability Number

V-283691

Group Title

SRG-NET-000512-L2S-000008

Rule Version

NOKI-L2-000200

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Remove the assignment of the default VLAN from all access switch ports.

Remove the access VPLS service ports using the default VLAN or wildcard VLAN tag "*" in VPLS SAP configurations:

- configure service vpls <service id>
- sap <port id:vlan tag> shutdown
- no sap <port id:vlan tag>

Check Contents

Review the switch configurations and verify no access switch ports have been assigned membership to the default VLAN (i.e., VLAN 1).

The service access points (SAPs) are configured to allow specific VLANs. Use the command below and verify the VLAN tag used for all SAPs.

When wild card "*" is configured in the VLAN tag portion of the SAP, it allows all VLAN tags, including VLAN 1.

For any port to be part of a virtual private local area network service (VPLS), the port must be configured for that service. Just enabling a port does not give the port access to a bridge domain. VLAN configuration is also part of configuring a port for a VPLS service.

- show service sap-using
Service Access Points
PortId SvcId Ing. Ing. Egr. Egr. Adm Opr
QoS Fltr QoS Fltr

1/1/c1/1:200 200 1 none 1 none Up Up
1/1/c1/1:300 300 1 none 1 none Up Up

If a port is configured with null encapsulation, it will allow all VLAN tags. Verify access ports are configured with "Port Encp" set to "dotq" or "qinq":

- show port
Ports on Slot 1

Port Admin Link Port Cfg Oper LAG/ Port Port Port C/QS/S/XFP/
Id State State MTU MTU Bndl Mode Encp Type MDIMDX

1/1/c1/1 Up Yes Up 1518 1518 - accs dotq cgige
1/1/c2 Up Link Up conn 100G CWDM4 M*

If access ports are assigned to the default VLAN, this is a finding.

Vulnerability Number

V-283691

Documentable

False

Rule Version

NOKI-L2-000200

Severity Override Guidance

Review the switch configurations and verify no access switch ports have been assigned membership to the default VLAN (i.e., VLAN 1).

The service access points (SAPs) are configured to allow specific VLANs. Use the command below and verify the VLAN tag used for all SAPs.

When wild card "*" is configured in the VLAN tag portion of the SAP, it allows all VLAN tags, including VLAN 1.

For any port to be part of a virtual private local area network service (VPLS), the port must be configured for that service. Just enabling a port does not give the port access to a bridge domain. VLAN configuration is also part of configuring a port for a VPLS service.

- show service sap-using
Service Access Points
PortId SvcId Ing. Ing. Egr. Egr. Adm Opr
QoS Fltr QoS Fltr

1/1/c1/1:200 200 1 none 1 none Up Up
1/1/c1/1:300 300 1 none 1 none Up Up

If a port is configured with null encapsulation, it will allow all VLAN tags. Verify access ports are configured with "Port Encp" set to "dotq" or "qinq":

- show port
Ports on Slot 1

Port Admin Link Port Cfg Oper LAG/ Port Port Port C/QS/S/XFP/
Id State State MTU MTU Bndl Mode Encp Type MDIMDX

1/1/c1/1 Up Yes Up 1518 1518 - accs dotq cgige
1/1/c2 Up Link Up conn 100G CWDM4 M*

If access ports are assigned to the default VLAN, this is a finding.

Check Content Reference

M

Target Key

5743