STIGQter: STIG Summary: Nokia Service Router OS 25.x Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia router must be configured to authenticate all routing protocol messages using National Institute of Standards and Technology (NIST)-validated Federal Information Processing Standards (FIPS) 198-1 message authentication code algorithm.

DISA Rule

SV-283911r1203982_rule

Vulnerability Number

V-283911

Group Title

SRG-NET-000168-RTR-000078

Rule Version

NOKI-RT-001000

Severity

CAT II

CCI(s)

• CCI-000803 - Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.

Weight

10

Fix Recommendation

Configure routing protocol authentication to use a NIST-validated FIPS 198-1 message authentication code algorithm using the example below:

- configure system security keychain "test" tcp-option-number send tcp-ao
- configure system security keychain "test" tcp-option-number receive tcp-ao
- configure system security keychain "test" direction bi entry 1 key 12345678901 algorithm aes-128-cmac-96 begin-time 2025/12/28 UTC 00:00:00
- configure system security keychain "test" direction bi entry 2 key 12345678901 algorithm aes-128-cmac-96 begin-time 2026/06/28 UTC 00:00:00

Check Contents

Review the router configuration to verify it is using a NIST-validated FIPS 198-1 message authentication code algorithm to authenticate routing protocol messages.

Use the command below and verify "Algorithm" configured for each keychain is a NIST-validated algorithm:

- show system security keychain "test" detail

Key chain:test

Description : (Not Specified)
TCP-Option number send : tcp-ao Admin state : Up
TCP-Option number receive : tcp-ao Oper state : Up
Used by : BGP
Expired : No

Key entries for key chain: test

Id : 1 Direction : send-receive
Algorithm : aes-128-cmac-96 Option : none
Admin State : Up RX Valid : Yes
TX Active : Yes Tolerance : 300
Begin Time : 2025/12/28 00:00:00 Begin Time (UTC) : 2025/12/28 00:00:00
End Time : 2026/06/28 00:00:00 End Time (UTC) : 2026/06/28 00:00:00

If a NIST-validated FIPS 198-1 message authentication code algorithm is not being used to authenticate routing protocol messages, this is a finding.

Vulnerability Number

V-283911

Documentable

False

Rule Version

NOKI-RT-001000

Severity Override Guidance

Review the router configuration to verify it is using a NIST-validated FIPS 198-1 message authentication code algorithm to authenticate routing protocol messages.

Use the command below and verify "Algorithm" configured for each keychain is a NIST-validated algorithm:

- show system security keychain "test" detail

Key chain:test

Description : (Not Specified)
TCP-Option number send : tcp-ao Admin state : Up
TCP-Option number receive : tcp-ao Oper state : Up
Used by : BGP
Expired : No

Key entries for key chain: test

Id : 1 Direction : send-receive
Algorithm : aes-128-cmac-96 Option : none
Admin State : Up RX Valid : Yes
TX Active : Yes Tolerance : 300
Begin Time : 2025/12/28 00:00:00 Begin Time (UTC) : 2025/12/28 00:00:00
End Time : 2026/06/28 00:00:00 End Time (UTC) : 2026/06/28 00:00:00

If a NIST-validated FIPS 198-1 message authentication code algorithm is not being used to authenticate routing protocol messages, this is a finding.

Check Content Reference

M

Target Key

5746