STIGQter: STIG Summary: Nokia Service Router OS 25.x Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia perimeter router must be configured to block all outbound management traffic.

DISA Rule

SV-283892r1203925_rule

Vulnerability Number

V-283892

Group Title

SRG-NET-000364-RTR-000113

Rule Version

NOKI-RT-000770

Severity

CAT II

CCI(s)

• CCI-002403 - Only allow incoming communications from organization-defined authorized sources routed to organization-defined authorized destinations.

Weight

10

Fix Recommendation

This requirement is not applicable for the DODIN Backbone.

Configure the perimeter router of the managed network with IPv4 and IPv6 filters on the egress interface to block all outbound management traffic using the example below:

Create an IPv4 filter:

- configure filter ip-filter 10
- config>filter>ip-filter# entry 10
- config>filter>ip-filter# entry 10 create
- config>filter>ip-filter>entry$ match dst-ip 172.10.1.0/24
- config>filter>ip-filter>entry$ action drop
- config>filter>ip-filter>entry$ exit
- config>filter>ip-filter# default-action forward
- config>filter>ip-filter# exit all

Create an IPv6 filter:

- configure filter ipv6-filter 20 create
- config>filter>ipv6-filter$ entry 10 create
- config>filter>ipv6-filter>entry$ match dst-ip 2001:acad:1234:200::1/64
- config>filter>ipv6-filter>entry$ action drop
- config>filter>ipv6-filter>entry$ exit
- config>filter>ipv6-filter$ default-action forward
- config>filter>ipv6-filter$ exit all

Apply the IPv4 filter and IPv6 filter on the interface:

- configure router interface "TO-PE2" egress filter ip 10
- configure router interface "TO-PE2" egress filter ipv6 20

Check Contents

This requirement is not applicable for the DODIN Backbone.

The perimeter router of the managed network must be configured with an access control list (ACL) or filter on the egress interface to block all management traffic.

Verify IPv4 and IPv6 filters are applied on the interface using the commands below:

- show router interface "TO-PE2" detail | match "Egress Filter"

Egress Filter : 10 Ingress Filter : 10

- show router interface "TO-PE2" detail | match "Egr IPv6 Flt"

Egr IPv6 Flt : 20 Ingr IPv6 Flt : none

If management traffic is not blocked at the perimeter, this is a finding.

Vulnerability Number

V-283892

Documentable

False

Rule Version

NOKI-RT-000770

Severity Override Guidance

This requirement is not applicable for the DODIN Backbone.

The perimeter router of the managed network must be configured with an access control list (ACL) or filter on the egress interface to block all management traffic.

Verify IPv4 and IPv6 filters are applied on the interface using the commands below:

- show router interface "TO-PE2" detail | match "Egress Filter"

Egress Filter : 10 Ingress Filter : 10

- show router interface "TO-PE2" detail | match "Egr IPv6 Flt"

Egr IPv6 Flt : 20 Ingr IPv6 Flt : none

If management traffic is not blocked at the perimeter, this is a finding.

Check Content Reference

M

Target Key

5746