STIGQter STIGQter: STIG Summary: Nokia Service Router OS 25.x Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia Provider Edge (PE) router must be configured to enforce a Quality-of-Service (QoS) policy to limit the effects of packet flooding denial-of-service (DoS) attacks.

DISA Rule

SV-283894r1203931_rule

Vulnerability Number

V-283894

Group Title

SRG-NET-000193-RTR-000112

Rule Version

NOKI-RT-000800

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Implement a mechanism for traffic prioritization and bandwidth reservation. This mechanism must enforce the traffic priorities specified by the Combatant Commands/Services/Agencies.

Nokia routers support multiple QoS policy types. Below is an example of how to configure and apply the SAP Ingress QoS policy.

Configure scheduler-policy using the example below:

- configure qos scheduler-policy TEST create
- config>qos>scheduler-policy$ tier 1
- config>qos>scheduler-policy>tier$ scheduler root create
- config>qos>scheduler-policy>tier>scheduler$ rate 107520 cir 107520
- config>qos>scheduler-policy>tier>scheduler$ exit
- config>qos>scheduler-policy>tier$ exit all

Configure QoS sap-ingress policy using the example below:

- configure qos sap-ingress 90 create
- config>qos>sap-ingress# queue 1 create
- config>qos>sap-ingress>queue# parent "root" cir-level 1
- config>qos>sap-ingress>queue# adaptation-rule pir max cir min
- config>qos>sap-ingress>queue# rate 107520 cir 40960
- config>qos>sap-ingress>queue# mbs 135 kilobytes
-config>qos>sap-ingress>queue# cbs 52
-config>qos>sap-ingress>queue# exit
-config>qos>sap-ingress# queue 2 create
-config>qos>sap-ingress>queue$ parent "root" level 2 cir-level 2
-config>qos>sap-ingress>queue$ adaptation-rule pir max cir min
-config>qos>sap-ingress>queue$ rate 107520 cir 10240
-config>qos>sap-ingress>queue$ mbs 135 kilobytes
-config>qos>sap-ingress>queue$ cbs 13
-config>qos>sap-ingress>queue$ exit
-config>qos>sap-ingress# queue 3 create
-config>qos>sap-ingress>queue$ parent "root" level 3 cir-level 3
-config>qos>sap-ingress>queue$ adaptation-rule pir max cir min
-config>qos>sap-ingress>queue$ rate 107520 cir 10240
-config>qos>sap-ingress>queue$ mbs 135 kilobytes
-config>qos>sap-ingress>queue$ cbs 13
-config>qos>sap-ingress>queue$ exit
-config>qos>sap-ingress# queue 4 create
-config>qos>sap-ingress>queue$ parent "root" level 4 cir-level 4
-config>qos>sap-ingress>queue$ adaptation-rule pir max cir min
-config>qos>sap-ingress>queue$ rate 40960 cir 40960
-config>qos>sap-ingress>queue$ mbs 52 kilobytes
-config>qos>sap-ingress>queue$ cbs 52
-config>qos>sap-ingress>queue$ exit
-config>qos>sap-ingress# queue 11 multipoint create
-config>qos>sap-ingress>queue# parent "root" cir-level 1
-config>qos>sap-ingress>queue# adaptation-rule pir max cir min
-config>qos>sap-ingress>queue# rate 20480 cir 5120
-config>qos>sap-ingress>queue# exit
-config>qos>sap-ingress# fc af create
-config>qos>sap-ingress>fc$ queue 3
-config>qos>sap-ingress>fc$ exit
-config>qos>sap-ingress# fc be create
-config>qos>sap-ingress>fc$ queue 1
-config>qos>sap-ingress>fc$ exit
-config>qos>sap-ingress# fc l1 create
-config>qos>sap-ingress>fc$ queue 4
-config>qos>sap-ingress>fc$ exit
-config>qos>sap-ingress# fc l2 create
-config>qos>sap-ingress>fc$ queue 2
-config>qos>sap-ingress>fc$ exit
-config>qos>sap-ingress# dscp "ef" fc l1
-config>qos>sap-ingress# dscp "cp9" fc l2
-config>qos>sap-ingress# dscp "af11" fc af
-config>qos>sap-ingress# exit all

Apply scheduler policy using the example below:

- configure service epipe 10 sap 1/1/c7/1 ingress scheduler-policy "TEST"

Apply QoS policy using the example below:

- configure service epipe 10 sap 1/1/c7/1 ingress qos 90

Check Contents

Review the router configuration and interview the system administrator to verify a mechanism for traffic prioritization and bandwidth reservation exists.

This arrangement must ensure that sufficient capacity is available for mission-critical traffic and enforce the traffic priorities specified by the Combatant Commands/Services/Agencies.

Verify QoS scheduler policy and service access point (SAP)-ingress policies are applied on the service access point using the command below:

- show service id 10 sap 1/1/c7/1 detail | match QOS post-lines 6
QOS
-------------------------------------------------------------------------------
Ingress qos-policy : 90 Egress qos-policy : 1
Ingress FP QGrp : (none) Egress Port QGrp : (none)
Ing FP QGrp Inst : (none) Egr Port QGrp Inst: (none)
Ing ip-match tag : none Ing ipv6-match tag: none
I. Sched Pol : TEST

If QoS scheduler-policy and SAP-ingress are not configured, this is a finding.

Vulnerability Number

V-283894

Documentable

False

Rule Version

NOKI-RT-000800

Severity Override Guidance

Review the router configuration and interview the system administrator to verify a mechanism for traffic prioritization and bandwidth reservation exists.

This arrangement must ensure that sufficient capacity is available for mission-critical traffic and enforce the traffic priorities specified by the Combatant Commands/Services/Agencies.

Verify QoS scheduler policy and service access point (SAP)-ingress policies are applied on the service access point using the command below:

- show service id 10 sap 1/1/c7/1 detail | match QOS post-lines 6
QOS
-------------------------------------------------------------------------------
Ingress qos-policy : 90 Egress qos-policy : 1
Ingress FP QGrp : (none) Egress Port QGrp : (none)
Ing FP QGrp Inst : (none) Egr Port QGrp Inst: (none)
Ing ip-match tag : none Ing ipv6-match tag: none
I. Sched Pol : TEST

If QoS scheduler-policy and SAP-ingress are not configured, this is a finding.

Check Content Reference

M

Target Key

5746