STIGQter: STIG Summary: Nokia Service Router OS 25.x Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia router must be configured to implement message authentication for all control plane protocols.

DISA Rule

SV-283912r1203985_rule

Vulnerability Number

V-283912

Group Title

SRG-NET-000230-RTR-000001

Rule Version

NOKI-RT-001010

Severity

CAT II

CCI(s)

• CCI-001184 - Protect the authenticity of communications sessions.
• CCI-000803 - Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.

Weight

10

Fix Recommendation

Configure authentication to be enabled for every protocol that affects the routing or forwarding tables using the example below:

Configure key chain:

- configure system security keychain "test" tcp-option-number send tcp-ao
- configure system security keychain "test" tcp-option-number receive tcp-ao
- configure system security keychain "test" direction bi entry 1 key 12345678901 algorithm aes-128-cmac-96 begin-time 2025/12/28 UTC 00:00:00
- configure system security keychain "test" direction bi entry 2 key 12345678901 algorithm aes-128-cmac-96 begin-time 2026/06/28 UTC 00:00:00

Apply the key chain to the BGP neighbor:

- configure router bgp group "eBGP" auth-keychain "test"

Check Contents

Review the router configuration.

For every protocol that affects the routing or forwarding tables (where information is exchanged between neighbors), verify neighbor router authentication is enabled using the command below:

- show system security keychain "test" detail

Key chain:test

Description : (Not Specified)
TCP-Option number send : tcp-ao Admin state : Up
TCP-Option number receive : tcp-ao Oper state : Up
Used by : BGP
Expired : No

Key entries for key chain: test

Id : 1 Direction : send-receive
Algorithm : aes-128-cmac-96 Option : none
Admin State : Up RX Valid : Yes
TX Active : Yes Tolerance : 300
Begin Time : 2025/12/28 00:00:00 Begin Time (UTC) : 2025/12/28 00:00:00
End Time : 2026/06/28 00:00:00 End Time (UTC) : 2026/06/28 00:00:00

If authentication is not enabled, this is a finding.

Vulnerability Number

V-283912

Documentable

False

Rule Version

NOKI-RT-001010

Severity Override Guidance

Review the router configuration.

For every protocol that affects the routing or forwarding tables (where information is exchanged between neighbors), verify neighbor router authentication is enabled using the command below:

- show system security keychain "test" detail

Key chain:test

Description : (Not Specified)
TCP-Option number send : tcp-ao Admin state : Up
TCP-Option number receive : tcp-ao Oper state : Up
Used by : BGP
Expired : No

Key entries for key chain: test

Id : 1 Direction : send-receive
Algorithm : aes-128-cmac-96 Option : none
Admin State : Up RX Valid : Yes
TX Active : Yes Tolerance : 300
Begin Time : 2025/12/28 00:00:00 Begin Time (UTC) : 2025/12/28 00:00:00
End Time : 2026/06/28 00:00:00 End Time (UTC) : 2026/06/28 00:00:00

If authentication is not enabled, this is a finding.

Check Content Reference

M

Target Key

5746