STIGQter: STIG Summary: Nokia Service Router OS 25.x Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia router must be configured to log all packets that have been dropped.

DISA Rule

SV-283898r1203943_rule

Vulnerability Number

V-283898

Group Title

SRG-NET-000078-RTR-000001

Rule Version

NOKI-RT-000870

Severity

CAT III

CCI(s)

• CCI-000134 - Ensure that audit records containing information that establishes the outcome of the event.

Weight

10

Fix Recommendation

Configure an IP filter to log all deny statements using the example below:

Create an IP filter:

- configure filter ip-filter 60 create
- config>filter>ip-filter$ entry 10 create
- config>filter>ip-filter>entry$ action drop
- config>filter>ip-filter>entry$ log 101
- config>filter>ip-filter>entry$ exit
- config>filter>ip-filter$ exit all

Apply the IP filter on the interface:

- configure router interface "TO-PE2" ingress filter ip 10

Check Contents

Review the IP filter to verify all deny statements are logged.

Use the commands below to verify the filter is logged and applied on the interface.

- show filter ip 60

Entry : 10
Description : (Not Specified)
Log Id : 101
Src. IP : 0.0.0.0/0
Src. Port : n/a
Dest. IP : 0.0.0.0/0
Dest. Port : n/a
Protocol : Undefined
Dscp : Undefined
ICMP Type : Undefined ICMP Code : Undefined
Fragment : Off Src Route Opt : Off
Sampling : Off Int. Sampling : On
IP-Option : 0/0 Multiple Option: Off
Tcp-flag : (Not Specified)
Option-pres : Off
Egress PBR : Disabled
Primary Action : Drop
Ing. Matches : 0 pkts
Egr. Matches : 0 pkts

- show router interface "TO-PE2" detail | match "Ingress Filter"

Egress Filter : 10 Ingress Filter : 10

If packets being dropped are not logged and a filter is not applied, this is a finding.

Vulnerability Number

V-283898

Documentable

False

Rule Version

NOKI-RT-000870

Severity Override Guidance

Review the IP filter to verify all deny statements are logged.

Use the commands below to verify the filter is logged and applied on the interface.

- show filter ip 60

Entry : 10
Description : (Not Specified)
Log Id : 101
Src. IP : 0.0.0.0/0
Src. Port : n/a
Dest. IP : 0.0.0.0/0
Dest. Port : n/a
Protocol : Undefined
Dscp : Undefined
ICMP Type : Undefined ICMP Code : Undefined
Fragment : Off Src Route Opt : Off
Sampling : Off Int. Sampling : On
IP-Option : 0/0 Multiple Option: Off
Tcp-flag : (Not Specified)
Option-pres : Off
Egress PBR : Disabled
Primary Action : Drop
Ing. Matches : 0 pkts
Egr. Matches : 0 pkts

- show router interface "TO-PE2" detail | match "Ingress Filter"

Egress Filter : 10 Ingress Filter : 10

If packets being dropped are not logged and a filter is not applied, this is a finding.

Check Content Reference

M

Target Key

5746