STIGQter: STIG Summary: Nokia Service Router OS 25.x Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia perimeter router must be configured to not redistribute static routes to an alternate gateway service provider into Border Gateway Protocol (BGP) or an Interior Gateway Protocol (IGP) peering with the NIPRNet or to other autonomous systems.

DISA Rule

SV-283883r1204025_rule

Vulnerability Number

V-283883

Group Title

SRG-NET-000019-RTR-000010

Rule Version

NOKI-RT-000660

Severity

CAT III

CCI(s)

• CCI-001414 - Enforce approved authorizations for controlling the flow of information between connected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

This requirement is not applicable for the DODIN Backbone.

Configure the router so static routes are not redistributed to an alternate gateway into either an EGP or IGP to the NIPRNet or to other autonomous systems, as shown in the example below:

Create a policy statement:

- configure router policy-options
- config>router>policy-options# begin
- config>router>policy-options# policy-statement EXPORT-STATIC
- config>router>policy-options>policy-statement$ entry 10
- config>router>policy-options>policy-statement>entry$ from protocol static
- config>router>policy-options>policy-statement>entry$ to protocol bgp
- config>router>policy-options>policy-statement>entry$ action drop
- config>router>policy-options>policy-statement>entry>action$ exit
- config>router>policy-options>policy-statement>entry$ exit
- config>router>policy-options>policy-statement$ exit
- config>router>policy-options# commit

Apply the export policy:

- configure router bgp group eBGP export "EXPORT-STATIC"

Check Contents

This requirement is not applicable for the DODIN Backbone.

Nokia routers do not automatically distribute static routes to IGP protocols unless a routing policy is applied to distribute these routes. Review the configuration of the router connecting to the alternate gateway and verify redistribution of static routes to the alternate gateway is not occurring.

Use this command for BGP neighbors and verify an "Export Policy" is defined:

- show router bgp neighbor 50.50.50.1 detail | match "Export Policy"

Export Policy : EXPORT-STATIC

If the static routes to the alternate gateway are being redistributed into BGP or any IGP peering with a NIPRNet gateway or another autonomous system, this is a finding.

Vulnerability Number

V-283883

Documentable

False

Rule Version

NOKI-RT-000660

Severity Override Guidance

This requirement is not applicable for the DODIN Backbone.

Nokia routers do not automatically distribute static routes to IGP protocols unless a routing policy is applied to distribute these routes. Review the configuration of the router connecting to the alternate gateway and verify redistribution of static routes to the alternate gateway is not occurring.

Use this command for BGP neighbors and verify an "Export Policy" is defined:

- show router bgp neighbor 50.50.50.1 detail | match "Export Policy"

Export Policy : EXPORT-STATIC

If the static routes to the alternate gateway are being redistributed into BGP or any IGP peering with a NIPRNet gateway or another autonomous system, this is a finding.

Check Content Reference

M

Target Key

5746