STIGQter: STIG Summary: Nokia Service Router OS 25.x Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia perimeter router must be configured to suppress Router Advertisements on all external IPv6-enabled interfaces.

DISA Rule

SV-283876r1204032_rule

Vulnerability Number

V-283876

Group Title

SRG-NET-000512-RTR-000014

Rule Version

NOKI-RT-000580

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Configure the router to suppress Router Advertisements on all external IPv6-enabled interfaces, as shown in the example below:

- configure router router-advertisement interface "TO-PE2" shutdown

Check Contents

This requirement is not applicable for the DODIN Backbone.

Review the router configuration to verify Router Advertisements are suppressed on all external IPv6-enabled interfaces.

Use the command below and verify for each interface the "RtrAdvertisement Tx" value:

- show router rtr-advertisement

Router Advertisement

Interface: TO-PE2
-------------------------------------------------------------------------------
Rtr Advertisement Tx : 4 Last Sent : 00h05m01s
Nbr Solicitation Tx : 3097 Last Sent : 00h00m53s
Nbr Advertisement Tx : 3078 Last Sent : 00h00m53s
Rtr Advertisement Rx : 0 Rtr Solicitation Rx : 0
Nbr Advertisement Rx : 3095 Nbr Solicitation Rx : 3078
-------------------------------------------------------------------------------
Max Advert Interval : 600 Min Advert Interval : 200
Managed Config : FALSE Other Config : FALSE
Reachable Time : 00h00m00s0ms Router Lifetime : 00h30m00s
Retransmit Time : 00h00m00s0ms Hop Limit : 64
Link MTU : 0 ND Router Preference : medium
MAC Addr To Use : Interface
Creation Origin : manual
No Prefixes

If the router is not configured to suppress Router Advertisements on all external IPv6-enabled interfaces, this is a finding.

Vulnerability Number

V-283876

Documentable

False

Rule Version

NOKI-RT-000580

Severity Override Guidance

This requirement is not applicable for the DODIN Backbone.

Review the router configuration to verify Router Advertisements are suppressed on all external IPv6-enabled interfaces.

Use the command below and verify for each interface the "RtrAdvertisement Tx" value:

- show router rtr-advertisement

Router Advertisement

Interface: TO-PE2
-------------------------------------------------------------------------------
Rtr Advertisement Tx : 4 Last Sent : 00h05m01s
Nbr Solicitation Tx : 3097 Last Sent : 00h00m53s
Nbr Advertisement Tx : 3078 Last Sent : 00h00m53s
Rtr Advertisement Rx : 0 Rtr Solicitation Rx : 0
Nbr Advertisement Rx : 3095 Nbr Solicitation Rx : 3078
-------------------------------------------------------------------------------
Max Advert Interval : 600 Min Advert Interval : 200
Managed Config : FALSE Other Config : FALSE
Reachable Time : 00h00m00s0ms Router Lifetime : 00h30m00s
Retransmit Time : 00h00m00s0ms Hop Limit : 64
Link MTU : 0 ND Router Preference : medium
MAC Addr To Use : Interface
Creation Origin : manual
No Prefixes

If the router is not configured to suppress Router Advertisements on all external IPv6-enabled interfaces, this is a finding.

Check Content Reference

M

Target Key

5746