OpenControls Logo

STIG Viewer

STIGViewer Support

The Nokia layer 2 switch must implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-283692NOKI-L2-000270SV-283692r1204104_ruleCCI-004891medium
Description
Separating critical system components and functions from other noncritical system components and functions through separate subnetworks may be necessary to reduce susceptibility to a catastrophic or debilitating breach or compromise that results in system failure. For example, physically separating the command and control function from the in-flight entertainment function through separate subnetworks in a commercial aircraft provides an increased level of assurance in the trustworthiness of critical system functions.
STIGDate
Nokia Service Router OS 25.x Layer 2 Switch Security Technical Implementation Guide2026-06-15

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (3) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CLD-03Cloud Infrastructure Security Subnet
0.50
NET-03.8Separate Subnet for Connecting to Different Security Domains
0.50
NET-06.1Security Management Subnets
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (8) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-3Access Enforcement
1.00
CM-6Configuration Settings
1.00
SC-47Alternate Communications Paths
1.00
SC-7Boundary Protection
1.00
SC-7(11)Restrict Incoming Communications Traffic
1.00
SC-7(29)Separate Subnets to Isolate Functions
1.00
SC-8Transmission Confidentiality and Integrity
1.00
CCI1 mapping
CCI-004891
1.00

Details

Check Text (C-283692r1204104_chk)

Verify the layer 2 switch is configured to implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions. Logical layer 2 switch separation is configured using separate virtual private local area network services (VPLS). Verify VPLS services created and access ports configured for each VPLS service using the commands below. To view all the VPLS services created, use the following command: - show service service-using vpls Services [vpls] =============================================================================== ServiceId Type Adm Opr CustomerId Service Name ------------------------------------------------------------------------------- 200 VPLS Up Up 1 200 300 VPLS Up Up 1 300 Use the command below to view all the access points that are part of each VPLS service: - show service id 200 base | match sap sap:1/1/c1/1:200 q-tag 1518 1518 Up Up If the layer 2 switch is not configured to implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions, this is a finding.

Fix Text (F-88162r1204103_fix)

Configure the layer 2 switch to implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions. A layer 2 switch VPLS service is a logically separate subnetwork. Configure a VPLS service using the following commands: - configure service vpls <vpls service id> customer <customer id> create - sap <port id:vlan tag if needed> create - back Add as many service access point (SAP) access ports as needed. If connection to a remote site is needed, add a service distribution point (SDP) tunnel to the remote endpoint: - spoke-sdp: <sdp id>:<vc id> create - back - no shutdown