STIGQter: STIG Summary: Nokia Service Router OS 25.x Router Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Apr 2026:

The Nokia router must establish organization-defined alternate communications paths for system operations organizational command and control.

DISA Rule

SV-283915r1203994_rule

Vulnerability Number

V-283915

Group Title

SRG-NET-000760-RTR-000160

Rule Version

NOKI-RT-001070

Severity

CAT II

CCI(s)

• CCI-004931 - Establish organization-defined alternate communications paths for system operations organizational command and control.

Weight

10

Fix Recommendation

Configure the mgmt port address for the out-of-band access using the example below:

- bof address 10.10.111.182/24

Configure the VPRN service for in-band management using the example below:

- configure service vprn 30 customer 1 create
- config>service>vprn# router-id 3.3.3.3
- config>service>vprn# autonomous-system 65100
- config>service>vprn# interface "management-network" create
- config>service>vprn>if# address 172.x.x.x/30
- config>service>vprn>if# sap 1/1/c3/1 create
- config>service>vprn>if>sap# exit
- config>service>vprn>if# exit
- config>service>vprn# bgp-ipvpn
- config>service>vprn>bgp-ipvpn# mpls
- config>service>vprn>bgp-ipvpn>mpls# auto-bind-tunnel
- config>service>vprn>bgp-ipvpn>mpls>auto-bind-tunnel# resolution any
- config>service>vprn>bgp-ipvpn>mpls>auto-bind-tunnel# exit
- config>service>vprn>bgp-ipvpn>mpls# route-distinguisher x.x.x.x:x
- config>service>vprn>bgp-ipvpn>mpls# vrf-target target:x:x
- config>service>vprn>bgp-ipvpn>mpls# no shutdown
- config>service>vprn>bgp-ipvpn>mpls# exit
- config>service>vprn>bgp-ipvpn# exit
- config>service>vprn# no shutdown

Check Contents

There are several alternate communication paths to manage the device. The management port can be used as the first communication path for out-of-band access. The Virtual Private Routed Network (VPRN) service can be used as the second communication path for in-band access. The console port can be used as the third communication path for out-of-band access.

Verify the mgmt port address using the command below:

- show bof | match address
address 10.10.111.182/24 active

Verify that only the routes and interfaces belonging to the management VPRN are present using the command below:

- show router 30 route-table

Route Table (Service: 30)

Dest Prefix[Flags] Type Proto Age Pref
Next Hop[Interface Name] Metric
-------------------------------------------------------------------------------
172.x.x.x/30 Remote BGP VPN 00h07m10s 170
4.4.4.4 (tunneled:RSVP:1) 30
172.x.x.x/30 Local Local 00h20m51s 0
management-network 0

If the mgmt port address and mgmt network are not configured in the VPRN, this is the finding.

Vulnerability Number

V-283915

Documentable

False

Rule Version

NOKI-RT-001070

Severity Override Guidance

There are several alternate communication paths to manage the device. The management port can be used as the first communication path for out-of-band access. The Virtual Private Routed Network (VPRN) service can be used as the second communication path for in-band access. The console port can be used as the third communication path for out-of-band access.

Verify the mgmt port address using the command below:

- show bof | match address
address 10.10.111.182/24 active

Verify that only the routes and interfaces belonging to the management VPRN are present using the command below:

- show router 30 route-table

Route Table (Service: 30)

Dest Prefix[Flags] Type Proto Age Pref
Next Hop[Interface Name] Metric
-------------------------------------------------------------------------------
172.x.x.x/30 Remote BGP VPN 00h07m10s 170
4.4.4.4 (tunneled:RSVP:1) 30
172.x.x.x/30 Local Local 00h20m51s 0
management-network 0

If the mgmt port address and mgmt network are not configured in the VPRN, this is the finding.

Check Content Reference

M

Target Key

5746