STIGQter STIGQter: STIG Summary: Nokia Service Router OS 25.x Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia Provider Edge (PE) router must be configured to have each Virtual Routing and Forwarding (VRF) instance with the appropriate Route Distinguisher (RD).

DISA Rule

SV-283901r1203952_rule

Vulnerability Number

V-283901

Group Title

SRG-NET-000512-RTR-000007

Rule Version

NOKI-RT-000900

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the correct RD for each VRF.

Use one of the commands below to configure the RD based on the architecture. RD ID uses the format as number: common value:

- configure service vprn 30 customer 1 bgp-ipvpn mpls route-distinguisher 3.3.3.3:30
- configure service vprn 30 customer 1 bgp-ipvpn mpls no shutdown

Check Contents

Review the RDs that have been assigned for each VRF according to the plan provided by the information system security manager (ISSM).

Review all VRFs configured on CE-facing interfaces and verify the proper RD has been configured for each.

Verify the "Route Dist." value for each service using the command below:

- show service id 30 base | match "Route Dist"

Route Dist. : 3.3.3.3:30 VPRN Type : regular
Oper Route Dist : 3.3.3.3:30

If the wrong RD has been configured for any VRF, this is a finding.

Vulnerability Number

V-283901

Documentable

False

Rule Version

NOKI-RT-000900

Severity Override Guidance

Review the RDs that have been assigned for each VRF according to the plan provided by the information system security manager (ISSM).

Review all VRFs configured on CE-facing interfaces and verify the proper RD has been configured for each.

Verify the "Route Dist." value for each service using the command below:

- show service id 30 base | match "Route Dist"

Route Dist. : 3.3.3.3:30 VPRN Type : regular
Oper Route Dist : 3.3.3.3:30

If the wrong RD has been configured for any VRF, this is a finding.

Check Content Reference

M

Target Key

5746