STIGQter STIGQter: STIG Summary: Nokia Service Router OS 25.x Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia Provider Edge (PE) router must be configured to block any traffic that is destined to Internet Protocol (IP) core infrastructure.

DISA Rule

SV-283880r1203889_rule

Vulnerability Number

V-283880

Group Title

SRG-NET-000205-RTR-000007

Rule Version

NOKI-RT-000620

Severity

CAT I

CCI(s)

Weight

10

Fix Recommendation

Configure protection for the IP core to be implemented at the edges by blocking any traffic with a destination address assigned to the IP core infrastructure, as shown in the example below:

Create an IPv4 filter:

- configure filter ip-filter 10
- config>filter>ip-filter# entry 10 create
- config>filter>ip-filter>entry# match dst-ip 172.150.150.2/30
- config>filter>ip-filter>entry# action drop
- config>filter>ip-filter>entry# exit all

Apply the IPv4 filter on the interface:

- configure router interface "TO-PE2" ingress filter ip 10

Check Contents

Review the router configuration to verify an ingress ACL is applied to all customer edge-facing interfaces.

Verify the filter is applied using the command below:

- show router interface "TO-PE2" detail | match "Ingress Filter"

Egress Filter : none Ingress Filter : 10

If the PE router is not configured to block any traffic with a destination address assigned to the IP core infrastructure, this is a finding.

Vulnerability Number

V-283880

Documentable

False

Rule Version

NOKI-RT-000620

Severity Override Guidance

Review the router configuration to verify an ingress ACL is applied to all customer edge-facing interfaces.

Verify the filter is applied using the command below:

- show router interface "TO-PE2" detail | match "Ingress Filter"

Egress Filter : none Ingress Filter : 10

If the PE router is not configured to block any traffic with a destination address assigned to the IP core infrastructure, this is a finding.

Check Content Reference

M

Target Key

5746