STIGQter STIGQter: STIG Summary: Nokia Service Router OS 25.x Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia perimeter router must be configured to only allow incoming communications from authorized sources to be routed to authorized destinations.

DISA Rule

SV-283833r1203748_rule

Vulnerability Number

V-283833

Group Title

SRG-NET-000364-RTR-000109

Rule Version

NOKI-RT-000150

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

This requirement is not applicable for the DODIN Backbone.

Configure the router to allow only incoming communications from authorized sources to be routed to authorized destinations, as shown in the example below:

IPv4 filter:

- configure filter ip-filter 10 create
- config>filter>ip-filter# entry 10 create
- config>filter>ip-filter>entry# match
- config>filter>ip-filter>entry>match# dst-ip 172.150.x.x/32
- config>filter>ip-filter>entry>match# src-ip 172.200.x.x/32
- config>filter>ip-filter>entry>match# exit
- config>filter>ip-filter>entry# action forward
- config>filter>ip-filter>entry# exit all

- configure router interface "TO-PE2" ingress filter ip 10

IPv6 filter:

- configure filter ipv6-filter 20 create
- config>filter>ipv6-filter# entry 10 create
- config>filter>ipv6-filter>entry# match
- config>filter>ipv6-filter>entry>match# dst-ip 2001:acad:1234:150::2/128
- config>filter>ipv6-filter>entry>match# src-ip 2001:acad:1234:200::2/128
- config>filter>ipv6-filter>entry>match# exit
- config>filter>ipv6-filter>entry# action forward
- config>filter>ipv6-filter>entry# exit all

- configure router interface "TO-PE2" ingress filter ipv6 20

Check Contents

This requirement is not applicable for the DODIN Backbone.

Review the router configuration to determine if the router allows only incoming communications from authorized sources to be routed to authorized destinations.

Use the command below and verify "Ingress Filter" or "Egress Filter", if needed, are applied:

- show filter ip 10

Entry : 10
Description : (Not Specified)
Log Id : n/a
Src. IP : 172.200.200.2/32
Src. Port : n/a
Dest. IP : 172.150.150.2/32
Dest. Port : n/a

- show filter ipv6 20

Filter Match Criteria : IPv6
-------------------------------------------------------------------------------
Entry : 10
Description : (Not Specified)
Log Id : n/a
Src. IP : 2001:acad:1234:200::2/128
Src. Port : n/a
Dest. IP : 2001:acad:1234:150::2/128
Dest. Port : n/a

If the router does not restrict incoming communications to allow only authorized sources and destinations, this is a finding.

Vulnerability Number

V-283833

Documentable

False

Rule Version

NOKI-RT-000150

Severity Override Guidance

This requirement is not applicable for the DODIN Backbone.

Review the router configuration to determine if the router allows only incoming communications from authorized sources to be routed to authorized destinations.

Use the command below and verify "Ingress Filter" or "Egress Filter", if needed, are applied:

- show filter ip 10

Entry : 10
Description : (Not Specified)
Log Id : n/a
Src. IP : 172.200.200.2/32
Src. Port : n/a
Dest. IP : 172.150.150.2/32
Dest. Port : n/a

- show filter ipv6 20

Filter Match Criteria : IPv6
-------------------------------------------------------------------------------
Entry : 10
Description : (Not Specified)
Log Id : n/a
Src. IP : 2001:acad:1234:200::2/128
Src. Port : n/a
Dest. IP : 2001:acad:1234:150::2/128
Dest. Port : n/a

If the router does not restrict incoming communications to allow only authorized sources and destinations, this is a finding.

Check Content Reference

M

Target Key

5746