STIGQter: STIG Summary: Nokia Service Router OS 25.x Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia Provider Edge (PE) router must be configured to enforce the split-horizon rule for all pseudowires within a virtual private local area network services (VPLS) bridge domain.

DISA Rule

SV-283909r1203976_rule

Vulnerability Number

V-283909

Group Title

SRG-NET-000512-RTR-000010

Rule Version

NOKI-RT-000980

Severity

CAT III

CCI(s)

CCI-000366 - Implement the security configuration settings.

Weight

Fix Recommendation

Enable split horizon on all PE routers deploying VPLS in a full-mesh configuration.

Configure VPLS service using mesh-sdp to have split-horizon function on the pseudowire using the example below:

- configure service vpls 100 customer 1 vpn 100 create
- config>service>vpls# mesh-sdp 40:100 create
- config>service>vpls>mesh-sdp$ no shutdown
- config>service>vpls>mesh-sdp$ exit
- config>service>vpls# no shutdown
- config>service>vpls# exit all

Check Contents

Review the PE router configuration to verify split horizon is enabled.

Verify the VPLS is using mesh-sdp using the command below:

- show service id 100 base | match "Service Access & Destination Points" post-lines 4
Service Access & Destination Points
-------------------------------------------------------------------------------
Identifier Type AdmMTU OprMTU Adm Opr
-------------------------------------------------------------------------------
sdp:40:100 M(4.4.4.4) Mesh 0 9190 Up Up

If the VPLS service SDP type is not mesh, this is a finding.

The Nokia Provider Edge (PE) router must be configured to enforce the split-horizon rule for all pseudowires within a virtual private local area network services (VPLS) bridge domain.

DISA Rule

Vulnerability Number

Group Title

Rule Version

Severity

CCI(s)

Weight

Fix Recommendation

Check Contents

Vulnerability Number

Documentable

Rule Version

Severity Override Guidance

Check Content Reference

Target Key