STIGQter STIGQter: STIG Summary: Nokia Service Router OS 25.x Layer 2 Switch Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia layer 2 switch must implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.

DISA Rule

SV-283692r1204104_rule

Vulnerability Number

V-283692

Group Title

SRG-NET-000715-L2S-000120

Rule Version

NOKI-L2-000270

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the layer 2 switch to implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.

A layer 2 switch VPLS service is a logically separate subnetwork. Configure a VPLS service using the following commands:

- configure service vpls <vpls service id> customer <customer id> create
- sap <port id:vlan tag if needed> create
- back

Add as many service access point (SAP) access ports as needed. If connection to a remote site is needed, add a service distribution point (SDP) tunnel to the remote endpoint:

- spoke-sdp: <sdp id>:<vc id> create
- back
- no shutdown

Check Contents

Verify the layer 2 switch is configured to implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.

Logical layer 2 switch separation is configured using separate virtual private local area network services (VPLS). Verify VPLS services created and access ports configured for each VPLS service using the commands below.

To view all the VPLS services created, use the following command:

- show service service-using vpls
Services [vpls]
===============================================================================
ServiceId Type Adm Opr CustomerId Service Name
-------------------------------------------------------------------------------
200 VPLS Up Up 1 200
300 VPLS Up Up 1 300

Use the command below to view all the access points that are part of each VPLS service:

- show service id 200 base | match sap
sap:1/1/c1/1:200 q-tag 1518 1518 Up Up

If the layer 2 switch is not configured to implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions, this is a finding.

Vulnerability Number

V-283692

Documentable

False

Rule Version

NOKI-L2-000270

Severity Override Guidance

Verify the layer 2 switch is configured to implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.

Logical layer 2 switch separation is configured using separate virtual private local area network services (VPLS). Verify VPLS services created and access ports configured for each VPLS service using the commands below.

To view all the VPLS services created, use the following command:

- show service service-using vpls
Services [vpls]
===============================================================================
ServiceId Type Adm Opr CustomerId Service Name
-------------------------------------------------------------------------------
200 VPLS Up Up 1 200
300 VPLS Up Up 1 300

Use the command below to view all the access points that are part of each VPLS service:

- show service id 200 base | match sap
sap:1/1/c1/1:200 q-tag 1518 1518 Up Up

If the layer 2 switch is not configured to implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions, this is a finding.

Check Content Reference

M

Target Key

5743