STIGQter: STIG Summary: Nokia Service Router OS 25.x Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia perimeter router must be configured drop IPv6 packets with a Routing Header type of 0, 1, or 3-255.

DISA Rule

SV-283840r1203769_rule

Vulnerability Number

V-283840

Group Title

SRG-NET-000364-RTR-000201

Rule Version

NOKI-RT-000220

Severity

CAT II

CCI(s)

CCI-002403 - Only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.

Weight

Fix Recommendation

Configure the router to drop IPv6 packets with Routing Header of type 0, 1, or 3-255.

Configure an IPv6 filter, as shown in the example below:

- configure filter ipv6-filter 20 create
- config>filter>ipv6-filter# entry 20 create
- config>filter>ipv6-filter>entry$ match routing-type0 true
- config>filter>ipv6-filter>entry$ action drop
- config>filter>ipv6-filter>entry$ exit all

Apply the IPv6 filter to the interface:

- configure router interface "TO-PE2" ingress filter ipv6 20

Check Contents

This requirement is not applicable for the DODIN Backbone.

Review the router configuration to determine if it is configured to drop IPv6 packets containing a Routing Header of type 0, 1, or 3-255.

Use the command below and determine if any "Ingr IPv6 Flt" is applied:

- show router interface "TO-PE2" detail | match "Ingr IPv6 Flt"

Egr IPv6 Flt : none Ingr IPv6 Flt : 20

If the router is not configured to drop IPv6 packets containing a Routing Header of type 0, 1, or 3-255, this is a finding.

The Nokia perimeter router must be configured drop IPv6 packets with a Routing Header type of 0, 1, or 3-255.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key