STIGQter: STIG Summary: Nokia Service Router OS 25.x Network Device Management Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia router must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services.

DISA Rule

SV-283768r1203574_rule

Vulnerability Number

V-283768

Group Title

SRG-APP-000142-NDM-000245

Rule Version

NOKI-ND-000330

Severity

CAT I

CCI(s)

• CCI-000382 - Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services.

Weight

10

Fix Recommendation

Configure the Nokia router to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services.

Disable FTP:

- configure system security no ftp-server
- configure system security no allow-ftp

Disable telnet:

- configure system security no telnet-server
- configure system security no allow-telnet
- configure system security no telnet6-server
- configure system security no allow-telnet6

Disable any other port/protocol using the management access filter:

- configure system security management-access-filter ip-filter
- default-action <permit | deny| deny-host-unreachable>
- entry <entry id>
- <match criteria> <match value>
- action <permit | deny| deny-host-unreachable>

Enable the management access ip filter:

- configure system security management-access-filter ip-filter no shutdown

Example of management-access-filter ipv6 filter configuration:

- configure system security management-access-filter ipv6-filter
- default-action <permit | deny| deny-host-unreachable>
- entry <entry id>
- <match criteria> <match value>
- action <permit | deny| deny-host-unreachable>

Enable the management access ipv6 filter:

- configure system security management-access-filter ipv6-filter no shutdown

Disable any other port/protocol using the CPM filter:

Example of cpm ipv6 filter configuration:

- configure system security cpm-filter ipv6-filter
- entry <id> create
- match <match criteria> <match value>
- action <action>

Enable the cpm ipv6 filter:

- configure system security cpm-filter ipv6-filter no shutdown

Example of cpm ipv4 filter configuration:

- configure system security cpm-filter ip-filter
- entry <id> create
- match <match criteria> <match value>
- action <action>

Enable the cpm ipv4 filter:

- configure system security cpm-filter ip-filter no shutdown

Example of ipv4 cpm filter to block HTTP:

- configure system security cpm-filter ip-filter
- entry 1 create
- match protocol tcp port 80
- action drop

Check Contents

Verify the router does not have any unnecessary or nonsecure functions, ports, protocols, and services enabled.

For example, verify that Telnet and FTP are disabled:

- show system information | match Tel
Tel/Tel6/SSH/FTP Admin : Disabled/Disabled/Enabled/Disabled
Tel/Tel6/SSH/FTP Oper : Down/Down/Up/Down

Any other TCP/UDP port can be disallowed using CPM and/or management filters.

Verify nonsecure functions and services are disabled by using the command below:

- show system security management-access-filter ip-filter
- show system security management-access-filter ipv6-filter
- show system security cpm-filter ip-filter
- show system security cpm-filter ipv6-filter

If any unnecessary or nonsecure functions, ports, protocols, or services are permitted, this is a finding.

Vulnerability Number

V-283768

Documentable

False

Rule Version

NOKI-ND-000330

Severity Override Guidance

Verify the router does not have any unnecessary or nonsecure functions, ports, protocols, and services enabled.

For example, verify that Telnet and FTP are disabled:

- show system information | match Tel
Tel/Tel6/SSH/FTP Admin : Disabled/Disabled/Enabled/Disabled
Tel/Tel6/SSH/FTP Oper : Down/Down/Up/Down

Any other TCP/UDP port can be disallowed using CPM and/or management filters.

Verify nonsecure functions and services are disabled by using the command below:

- show system security management-access-filter ip-filter
- show system security management-access-filter ipv6-filter
- show system security cpm-filter ip-filter
- show system security cpm-filter ipv6-filter

If any unnecessary or nonsecure functions, ports, protocols, or services are permitted, this is a finding.

Check Content Reference

M

Target Key

5744