STIGQter: STIG Summary: Nokia Service Router OS 25.x Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia router must be configured to restrict traffic destined to itself.

DISA Rule

SV-283841r1203772_rule

Vulnerability Number

V-283841

Group Title

SRG-NET-000205-RTR-000001

Rule Version

NOKI-RT-000230

Severity

CAT I

CCI(s)

• CCI-001097 - Monitor and control communications at the external managed interfaces to the system and at key managed interfaces within the system.

Weight

10

Fix Recommendation

Configure all routers with receive path filters to restrict traffic destined to the router.

Create a cpm-filter to control traffic to the control plane module, as shown below:

CPM-filter for IPv4 traffic:

- configure system security cpm-filter
- config>sys>security>cpm-filter# default-action accept
- config>sys>security>cpm-filter# ip-filter
- config>sys>sec>cpm>ip-filter# entry 10 create
- cfg>sys>sec>cpm>ip-filter>entry# match src-ip 100.100.100.100/32
- cfg>sys>sec>cpm>ip-filter>entry# match protocol "icmp"
- cfg>sys>sec>cpm>ip-filter>entry>match# back
- cfg>sys>sec>cpm>ip-filter>entry# action accept
- cfg>sys>sec>cpm>ip-filter>entry# action drop
- cfg>sys>sec>cpm>ip-filter>entry# exit
- config>sys>sec>cpm>ip-filter# no shutdown
- config>sys>sec>cpm>ip-filter# exit all

CPM-Filter for IPv6 traffic:

- configure system security cpm-filter
- config>sys>security>cpm-filter# default-action accept
- config>sys>security>cpm-filter# ipv6-filter
- config>sys>sec>cpm>ipv6-filter# entry 20 create
- cfg>sys>sec>cpm>ipv6-filter>entry# match src-ip 2001:acad:1234:200::2/128
- cfg>sys>sec>cpm>ipv6-filter>entry# action drop
- cfg>sys>sec>cpm>ipv6-filter>entry# exit
- config>sys>sec>cpm>ipv6-filter# no shutdown
- config>sys>sec>cpm>ipv6-filter# exit all

Check Contents

Review the access control list (ACL) or filter for the router receive path and verify it will only process specific management plane and control plane traffic from specific sources, as shown in the example below:

- show system security cpm-filter ip-filter entry 10

CPM IP Filter Entry

Entry Id : 10
Description : (Not Specified)
-------------------------------------------------------------------------------
Filter Entry Match Criteria :
-------------------------------------------------------------------------------
Log Id : n/a
Src. IP : 100.100.100.100/32
Src. Port : n/a
Dst. IP : n/a
Dest. Port : n/a
Protocol : icmp Dscp : Undefined

- show system security cpm-filter ipv6-filter entry 20

CPM IPv6 Filter Entry

Entry Id : 20
Description : (Not Specified)
-------------------------------------------------------------------------------
Filter Entry Match Criteria :
-------------------------------------------------------------------------------
Log Id : n/a
Src. IP : 2001:acad:1234:200::2/128

If the router is not configured with a receive-path filter to restrict traffic destined to itself, this is a finding.

Vulnerability Number

V-283841

Documentable

False

Rule Version

NOKI-RT-000230

Severity Override Guidance

Review the access control list (ACL) or filter for the router receive path and verify it will only process specific management plane and control plane traffic from specific sources, as shown in the example below:

- show system security cpm-filter ip-filter entry 10

CPM IP Filter Entry

Entry Id : 10
Description : (Not Specified)
-------------------------------------------------------------------------------
Filter Entry Match Criteria :
-------------------------------------------------------------------------------
Log Id : n/a
Src. IP : 100.100.100.100/32
Src. Port : n/a
Dst. IP : n/a
Dest. Port : n/a
Protocol : icmp Dscp : Undefined

- show system security cpm-filter ipv6-filter entry 20

CPM IPv6 Filter Entry

Entry Id : 20
Description : (Not Specified)
-------------------------------------------------------------------------------
Filter Entry Match Criteria :
-------------------------------------------------------------------------------
Log Id : n/a
Src. IP : 2001:acad:1234:200::2/128

If the router is not configured with a receive-path filter to restrict traffic destined to itself, this is a finding.

Check Content Reference

M

Target Key

5746