The Nokia layer 2 switch must enable Ethernet Connectivity Fault Management (ETH-CFM) to protect against one-way connections.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-283689 | NOKI-L2-000170 | SV-283689r1204095_rule | CCI-000366 | medium |
| Description | ||||
| In topologies where fiber optic interconnections are used, physical misconnections can occur that allow a link to appear to be up when there is a mismatched set of transmit/receive pairs. When such a physical misconfiguration occurs, protocols such as Spanning Tree Protocol (STP) can cause network instability. Enabling ETH-CFM is the standard and most effective way to protect a layer 2 service against one-way (unidirectional) connections on a Nokia 7750 SR. The constant, bidirectional exchange of Continuity Check Messages (CCMs) provides an "always-on" monitoring system. It ensures that connectivity is healthy in both directions, detecting silent failures that would be missed by on-demand tests such as a loopback (ping). | ||||
| STIG | Date | |||
| Nokia Service Router OS 25.x Layer 2 Switch Security Technical Implementation Guide | 2026-06-15 | |||
Details
Check Text (C-283689r1204095_chk)
Verify the ETH-CFM configuration for the service access point (SAP) in the virtual private local area network service (VPLS) appears as shown in the example below.
- show service id 10 sap 1/1/c3/10 detail
Eth-Cfm MEP Configuration Information
Md-index : 3 Direction : Down
Ma-index : 1 Admin : Enabled
MepId : 10 CCM-Enable : Enabled
If ETH-CFM is not configured to protect against one-way connections, this is a finding.
Fix Text (F-88159r1204094_fix)
Configure the ETH-CFM maintenance domain and bind the Maintenance Endpoint (MEP) to the SAP to be monitored. Use the CCMs to detect possible unidirectional issues.
Configure ETH-CFM domain information:
- configure eth-cfm domain <domain id> format none level <level>
- association 1 format icc-based name <name>
- bridge-identifier bridge-name <vpls service name>
- back
- remote-mepid <mep id>
Apply to the SAP within VPLS:
- configure service vpls <id>
- sap <sap id> eth-cfm mep <mep id> domain <domain id> association <index>
- ccm-enable
- no shutdown