STIGQter: STIG Summary: Nokia Service Router OS 25.x Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia perimeter router must be configured to have Proxy ARP disabled on all external interfaces.

DISA Rule

SV-283821r1204035_rule

Vulnerability Number

V-283821

Group Title

SRG-NET-000364-RTR-000112

Rule Version

NOKI-RT-000030

Severity

CAT II

CCI(s)

CCI-002403 - Only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.

Weight

Fix Recommendation

This requirement is not applicable for the DODIN Backbone.

Disable Proxy ARP on all external interfaces, as shown in the example below:

- configure router interface "TO-PE2" no local-proxy-arp
- configure router interface "TO-PE2" no remote-proxy-arp

Check Contents

This requirement is not applicable for the DODIN Backbone.

Review the router configuration to determine if IP Proxy ARP is enabled on any external interfaces, as shown in the example below.

For each interface, use the command below, and in the "Proxy ARP Details" section, verify "Rem Proxy ARP" and "Local Proxy ARP" are disabled:

- show router interface "TO-PE2" detail | match Proxy

Proxy ARP Details
Rem Proxy ARP : Disabled Local Proxy ARP : Disabled

Note: Proxy ARP is disabled by default.

If IP Proxy ARP is enabled on any external interface, this is a finding.

The Nokia perimeter router must be configured to have Proxy ARP disabled on all external interfaces.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key