STIGQter: STIG Summary: Nokia Service Router OS 25.x Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia Multicast Source Discovery Protocol (MSDP) router must be configured to filter source-active multicast advertisements to external MSDP peers to avoid global visibility of local-only multicast sources and groups.

DISA Rule

SV-283835r1203754_rule

Vulnerability Number

V-283835

Group Title

SRG-NET-000018-RTR-000008

Rule Version

NOKI-RT-000170

Severity

CAT III

CCI(s)

• CCI-001368 - Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Ensure an export policy is implemented on all MSDP routers to avoid global visibility of local multicast (S, G) states. Create an export policy.

Configure prefix-list, as shown in the example below:

- configure router policy-options
- config>router>policy-options# begin
- config>router>policy-options# prefix-list "Multicast-Group-Source"
- config>router>policy-options>prefix-list# prefix 233.0.0.0/8 exact
- config>router>policy-options>prefix-list# prefix 172.200.200.2/32 exact
- config>router>policy-options>prefix-list# exit

Configure policy, as shown in the example below:

- config>router>policy-options# policy-statement "MSDP-EXPORT-SA"
- config>router>policy-options>policy-statement# entry 10
- config>router>policy-options>policy-statement>entry# from prefix-list "Multicast-Group-Source"
- config>router>policy-options>policy-statement>entry# action drop
- config>router>policy-options>policy-statement>entry>action# exit
- config>router>policy-options>policy-statement>entry# exit
- config>router>policy-options>policy-statement# default-action accept
- config>router>policy-options>policy-statement>default-action# exit
- config>router>policy-options>policy-statement# exit
- config>router>policy-options# commit
- config>router>policy-options# exit all

Apply the export policy to the MSDP peer:

- configure router msdp peer 1.1.1.1 export "MSDP-EXPORT-SA"

Check Contents

Review the Nokia router configuration to determine if there is export policy to block local source-active multicast advertisements.

Verify the export policy, as shown in the example below:

- show router msdp peer 1.1.1.1 detail | match "Export Policy"
Export Policy : MSDP-EXPORT-SA

If the router is not configured with an export policy to filter local source-active multicast advertisements, this is a finding.

Vulnerability Number

V-283835

Documentable

False

Rule Version

NOKI-RT-000170

Severity Override Guidance

Review the Nokia router configuration to determine if there is export policy to block local source-active multicast advertisements.

Verify the export policy, as shown in the example below:

- show router msdp peer 1.1.1.1 detail | match "Export Policy"
Export Policy : MSDP-EXPORT-SA

If the router is not configured with an export policy to filter local source-active multicast advertisements, this is a finding.

Check Content Reference

M

Target Key

5746