OpenControls Logo

STIG Viewer

STIGViewer Support

The Nokia layer 2 switch must assign all virtual private local area network service (VPLS) ports not in use to an inactive VLAN.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-283690NOKI-L2-000190SV-283690r1204098_ruleCCI-000366medium
Description
A disabled port assigned to a user or management VLAN could be enabled accidentally or by an attacker. As a result, the attacker could gain access to that VLAN as a member. Satisfies: SRG-NET-000512-L2S-000007, SRG-NET-000512-L2S-000009, SRG-NET-000512-L2S-000010, SRG-NET-000512-L2S-000011, SRG-NET-000512-L2S-000012, SRG-NET-000512-L2S-000013
STIGDate
Nokia Service Router OS 25.x Layer 2 Switch Security Technical Implementation Guide2026-06-15

Related Frameworks

1 mapping across 5 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (8) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CFG-01Configuration Management Program
1.00
END-01Endpoint Device Management (EDM)
1.00
END-04Malicious Code Protection (Anti-Malware)
1.00
END-06Endpoint File Integrity Monitoring (FIM)
1.00
MON-01Continuous Monitoring
1.00
MON-01.7File Integrity Monitoring (FIM)
1.00
CFG-02Secure Baseline Configurations
0.50
CFG-02.7Approved Configuration Deviations
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (100) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-12Session Termination
1.00
AC-16(1)Dynamic Attribute Association
1.00
AC-17(1)Monitoring and Control
1.00
AC-2Account Management
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(11)Usage Conditions
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-24(1)Transmit Access Authorization Information
1.00
AC-25Reference Monitor
1.00

+90 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.4.1
1.00
3.4.2
1.00
CCI1 mapping
CCI-000366
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (5) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

DE.CM-09
1.00
PR.PS-01
1.00
PR.DS-10
0.50
PR.PSPlatform Security
0.50
PR.PS-05
0.50

Who does this work

10 NICE work roles and 9 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-283690r1204098_chk)

Note: Switch ports configured for 802.1x are exempt from this requirement. Review Nokia router configurations and examine all access switch ports. Each access switch port not in use should have membership to an inactive VLAN that is not used for any purpose. For any port to be part of a VPLS service, the port must be configured for that service. Just enabling a port does not give the port access to a bridge domain. VLAN configuration is also part of configuring a port for a VPLS service. Use the command below to verify all VLAN tags used for all VPLS services. Pay attention to wildcard "*" usage in the VLAN tag portion of the service access point (SAP) ID configuration. When the wild card "*" is configured in the VLAN tag portion of the SAP, it allows all VLAN tags. - show service sap-using Service Access Points PortId SvcId Ing. Ing. Egr. Egr. Adm Opr QoS Fltr QoS Fltr 1/1/c1/1:200 200 1 none 1 none Up Up 1/1/c1/1:300 300 1 none 1 none Up Up If a port is configured with null encapsulation, it will allow all VLAN tags. Verify access ports are configured with "Port Encp" set to "dotq" or "qinq": - show port Ports on Slot 1 Port Admin Link Port Cfg Oper LAG/ Port Port Port C/QS/S/XFP/ Id State State MTU MTU Bndl Mode Encp Type MDIMDX 1/1/c1/1 Up Yes Up 1518 1518 - accs dotq cgige 1/1/c2 Up Link Up conn 100G CWDM4 M* If any access switch ports are not in use and not in an inactive VLAN, this is a finding.

Fix Text (F-88160r1204097_fix)

Note: Switch ports configured for 802.1x are exempt from this requirement. Assign all VPLS service ports not in use to an inactive VLAN. Configure VPLS service access ports with either dot1q or qinq encapsulation: - configure port <port id> ethernet encap-type <dot1q or qinq> Configure unused SAPs with inactive VLAN tag in VPLS SAP configurations: - configure service vpls <service id> - sap <port id:vlan tag> create