STIGQter: STIG Summary: Nokia Service Router OS 25.x Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia multicast router must be configured to bind a Protocol Independent Multicast (PIM) neighbor filter to interfaces that have PIM enabled.

DISA Rule

SV-283866r1203847_rule

Vulnerability Number

V-283866

Group Title

SRG-NET-000019-RTR-000004

Rule Version

NOKI-RT-000480

Severity

CAT II

CCI(s)

• CCI-001414 - Enforce approved authorizations for controlling the flow of information between connected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

This requirement is not applicable for the DODIN Backbone.

Configure IPv4 and IPv6 filters to only accept PIM control plane traffic from documented PIM neighbors and apply them to all PIM-enabled interfaces, as shown in the example below:

Configure IPv4 and IPv6 filter:

- configure filter ip-filter 50 create
- config>filter>ip-filter$ entry 10
- config>filter>ip-filter$ entry 10 create
- config>filter>ip-filter>entry$ match protocol "pim"
- config>filter>ip-filter>entry>match$ src-ip 192.100.50.1/30
- config>filter>ip-filter>entry>match$ exit
- config>filter>ip-filter>entry$ action forward
- config>filter>ip-filter>entry$ exit
- config>filter>ip-filter$ default-action drop
- config>filter>ip-filter$ exit all

- configure filter ipv6-filter 60
- config>filter>ipv6-filter# entry 10 create
- config>filter>ipv6-filter>entry# match next-header 103
- config>filter>ipv6-filter>entry>match# exit
- config>filter>ipv6-filter>entry# action drop
- config>filter>ipv6-filter>entry# exit all

Apply the IPv4 filter and IPv6 on the interface:

- configure router interface "TO-PE3" ingress filter ip 50
- configure router interface "TO-PE3" ingress filter ipv6 60

Check Contents

This requirement is not applicable for the DODIN Backbone.

Review the multicast topology diagram and determine if router interfaces are enabled for IPv4 or IPv6 multicast routing.

Verify the IPv4 and IPv6 filter is applied on the PIM-enabled interface using the command below:

- show router interface "TO-PE3" detail | match "Ingress Filter"

Egress Filter : none Ingress Filter : 50

- show router interface "TO-PE3" detail | match "Ingr IPv6 Flt"

Egr IPv6 Flt : none Ingr IPv6 Flt : 60

If PIM neighbor filters are not bound to all interfaces that have PIM enabled, this is a finding.

Vulnerability Number

V-283866

Documentable

False

Rule Version

NOKI-RT-000480

Severity Override Guidance

This requirement is not applicable for the DODIN Backbone.

Review the multicast topology diagram and determine if router interfaces are enabled for IPv4 or IPv6 multicast routing.

Verify the IPv4 and IPv6 filter is applied on the PIM-enabled interface using the command below:

- show router interface "TO-PE3" detail | match "Ingress Filter"

Egress Filter : none Ingress Filter : 50

- show router interface "TO-PE3" detail | match "Ingr IPv6 Flt"

Egr IPv6 Flt : none Ingr IPv6 Flt : 60

If PIM neighbor filters are not bound to all interfaces that have PIM enabled, this is a finding.

Check Content Reference

M

Target Key

5746