STIGQter: STIG Summary: Nokia Service Router OS 25.x Network Device Management Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia router must use Federal Information Processing Standard (FIPS)-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of nonlocal maintenance and diagnostic communications.

DISA Rule

SV-283782r1223371_rule

Vulnerability Number

V-283782

Group Title

SRG-APP-000411-NDM-000330

Rule Version

NOKI-ND-000740

Severity

CAT I

CCI(s)

• CCI-002890 - Implement organization-defined cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications.
• CCI-003123 - Implement organization-defined cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.

Weight

10

Fix Recommendation

Configure the Nokia router to use FIPS-validated HMAC to protect the integrity of nonlocal maintenance and diagnostic communications.

When in FIPS mode, the non-FIPS algorithms are removed. To remove any of SSH ciphers, use the command below:

- configure system security ssh

Use the command below to view all ciphers available for "client-cipher-list", "server-cipher-list", "client-mac-list", and "server-mac-list":

- info detail

Remove any unwanted cipher from any of the lists above using the command below. For example, to remove cipher id 190 from server-cipher-list, use the following:

- server-cipher-list no cipher 190

Check Contents

Verify the Nokia router uses FIPS-validated HMAC to protect the integrity of nonlocal maintenance and diagnostic communications.

SSH server list example:

- show system security ssh server-lists

SSH Server configurable algorithm lists

SSHv2 Cipher List : aes256-ctr
aes192-ctr
aes128-ctr
aes128-cbc
aes192-cbc
aes256-cbc

SSHv2 MAC List : hmac-sha2-512
hmac-sha2-256

SSHv2 KEX List : ecdh-sha2-nistp521
ecdh-sha2-nistp384
ecdh-sha2-nistp256
diffie-hellman-group16-sha512
diffie-hellman-group14-sha256

SSHv2 Host Key List : ecdsa-sha2-nistp521
ecdsa-sha2-nistp256
rsa-sha2-512
rsa-sha2-256

SSH client list example:

- show system security ssh client-lists

If the Nokia router does not use FIPS-validated HMAC to protect the integrity of nonlocal maintenance and diagnostic communications, this is a finding.

Vulnerability Number

V-283782

Documentable

False

Rule Version

NOKI-ND-000740

Severity Override Guidance

Verify the Nokia router uses FIPS-validated HMAC to protect the integrity of nonlocal maintenance and diagnostic communications.

SSH server list example:

- show system security ssh server-lists

SSH Server configurable algorithm lists

SSHv2 Cipher List : aes256-ctr
aes192-ctr
aes128-ctr
aes128-cbc
aes192-cbc
aes256-cbc

SSHv2 MAC List : hmac-sha2-512
hmac-sha2-256

SSHv2 KEX List : ecdh-sha2-nistp521
ecdh-sha2-nistp384
ecdh-sha2-nistp256
diffie-hellman-group16-sha512
diffie-hellman-group14-sha256

SSHv2 Host Key List : ecdsa-sha2-nistp521
ecdsa-sha2-nistp256
rsa-sha2-512
rsa-sha2-256

SSH client list example:

- show system security ssh client-lists

If the Nokia router does not use FIPS-validated HMAC to protect the integrity of nonlocal maintenance and diagnostic communications, this is a finding.

Check Content Reference

M

Target Key

5744