STIGQter STIGQter: STIG Summary: Nokia Service Router OS 25.x Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia multicast edge router must be configured to establish boundaries for administratively scoped multicast traffic.

DISA Rule

SV-283888r1203913_rule

Vulnerability Number

V-283888

Group Title

SRG-NET-000019-RTR-000005

Rule Version

NOKI-RT-000730

Severity

CAT III

CCI(s)

Weight

10

Fix Recommendation

Create an IPv4 filter using the example below:

- configure filter ip-filter 10
- config>filter>ip-filter# default-action forward
- config>filter>ip-filter# entry 10 create
- config>filter>ip-filter>entry$ match dst-ip 239.0.0.0/8
- config>filter>ip-filter>entry$ action drop
- config>filter>ip-filter>entry$ exit all

Apply an IPv4 filter on the interface using the example below:

- configure router interface "TO-PE3" ingress filter ip 10

Check Contents

Review the router configuration and verify admin-scope multicast traffic is blocked at the external edge.

Use the command below to display the IPv4 filter applied.

- show router interface "TO-PE3" detail | match "Ingress Filter"

Egress Filter : none Ingress Filter : 10

If the router is not configured to establish boundaries for administratively scoped multicast traffic, this is a finding.

Vulnerability Number

V-283888

Documentable

False

Rule Version

NOKI-RT-000730

Severity Override Guidance

Review the router configuration and verify admin-scope multicast traffic is blocked at the external edge.

Use the command below to display the IPv4 filter applied.

- show router interface "TO-PE3" detail | match "Ingress Filter"

Egress Filter : none Ingress Filter : 10

If the router is not configured to establish boundaries for administratively scoped multicast traffic, this is a finding.

Check Content Reference

M

Target Key

5746