STIGQter: STIG Summary: Nokia Service Router OS 25.x Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia Multicast Source Discovery Protocol (MSDP) router must be configured to only accept MSDP packets from known MSDP peers.

DISA Rule

SV-283873r1203868_rule

Vulnerability Number

V-283873

Group Title

SRG-NET-000364-RTR-000116

Rule Version

NOKI-RT-000550

Severity

CAT II

CCI(s)

• CCI-002403 - Only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.

Weight

10

Fix Recommendation

Configure MSDP routers to only accept MSDP packets from known MSDP peers, as shown in the example below:

Create an IPv4 filter:

- configure filter ip-filter 10 create
- config>filter>ip-filter# entry 10
- config>filter>ip-filter>entry# match protocol "tcp"
- config>filter>ip-filter>entry>match# src-port 639 eq
- config>filter>ip-filter>entry>match# src-ip 2.2.2.2/32
- config>filter>ip-filter>entry>match# dst-ip 1.1.1.1/32
- config>filter>ip-filter>entry>match# exit
- config>filter>ip-filter>entry# action accept
- config>filter>ip-filter>entry# exit all

Apply the IPv4 filter on the interface:

- configure router interface "TO-PE2" ingress filter ip 10

Check Contents

Review the router configuration to determine if there is a receive path or interface filter to only accept MSDP packets from known MSDP peers.

Verify the filter is applied on the interface using the command below:

- show router interface "TO-PE2" detail | match "Ingress Filter"
Egress Filter : none Ingress Filter : 10

If the router is not configured to only accept MSDP packets from known MSDP peers, this is a finding.

Vulnerability Number

V-283873

Documentable

False

Rule Version

NOKI-RT-000550

Severity Override Guidance

Review the router configuration to determine if there is a receive path or interface filter to only accept MSDP packets from known MSDP peers.

Verify the filter is applied on the interface using the command below:

- show router interface "TO-PE2" detail | match "Ingress Filter"
Egress Filter : none Ingress Filter : 10

If the router is not configured to only accept MSDP packets from known MSDP peers, this is a finding.

Check Content Reference

M

Target Key

5746