STIGQter: STIG Summary: Nokia Service Router OS 25.x Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia Provider Edge (PE) router providing virtual private local area network services (VPLS) must be configured to have traffic broadcast storm thresholds on customer edge-facing interfaces.

DISA Rule

SV-283910r1203979_rule

Vulnerability Number

V-283910

Group Title

SRG-NET-000193-RTR-000002

Rule Version

NOKI-RT-000990

Severity

CAT II

CCI(s)

• CCI-001095 - Manage capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial of service attacks.

Weight

10

Fix Recommendation

Configure QoS SAP-ingress to control broadcast storm for each VPLS bridge domain. Base the suppression threshold on expected traffic rates plus some additional capacity.

Configure QoS SAP-ingress using the example below:

- configure qos sap-ingress 100 create
- config>qos>sap-ingress# policer 10 create
- config>qos>sap-ingress>policer# rate 12000
- config>qos>sap-ingress>policer# exit
- config>qos>sap-ingress# fc "be" create
- config>qos>sap-ingress>fc# broadcast-policer 10
- config>qos>sap-ingress>fc# exit
- config>qos>sap-ingress# exit all

Apply the QoS SAP-ingress policy to the SAP using the example below:

- configure service vpls 20 sap 1/1/c7/1 ingress qos 100

Check Contents

Review the router configuration to verify Quality-of-Service (QoS) SAP-ingress is applied on the service access point (SAP), deploying VPLS to control broadcast storm.

Verify the QoS SAP-ingress policy is applied to the SAP using the configuration below:

- show service id 20 sap 1/1/c7/1 qos | match "Ingress qos-policy"
Ingress qos-policy : 100 Egress qos-policy : 1

If the QoS SAP-ingress is not applied to the SAP, this is a finding.

Vulnerability Number

V-283910

Documentable

False

Rule Version

NOKI-RT-000990

Severity Override Guidance

Review the router configuration to verify Quality-of-Service (QoS) SAP-ingress is applied on the service access point (SAP), deploying VPLS to control broadcast storm.

Verify the QoS SAP-ingress policy is applied to the SAP using the configuration below:

- show service id 20 sap 1/1/c7/1 qos | match "Ingress qos-policy"
Ingress qos-policy : 100 Egress qos-policy : 1

If the QoS SAP-ingress is not applied to the SAP, this is a finding.

Check Content Reference

M

Target Key

5746