The Nokia Provider Edge (PE) router providing virtual private local area network services (VPLS) must be configured to have all attachment circuits defined to the virtual forwarding instance (VFI) with the globally unique VPN ID assigned for each customer VLAN.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-283826 | NOKI-RT-000080 | SV-283826r1203727_rule | CCI-000366 | high |
| Description | ||||
| VPLS defines an architecture that delivers Ethernet multipoint services over a Multiprotocol Label Switching (MPLS) network. Customer layer 2 frames are forwarded across the MPLS core via pseudowires using IEEE 802.1q Ethernet bridging principles. A pseudowire is a virtual bidirectional connection between two attachment circuits (virtual connections between PE and CE routers). A pseudowire contains two unidirectional label-switched paths (LSP) between two PE routers. Each MAC virtual forwarding instance (VFI) table is interconnected using pseudowires provisioned for the bridge domain, thereby maintaining privacy and logical separation between each VPLS bridge domain. The VFI specifies the pseudowires associated with connecting PE routers and the customer-facing attachment circuits belonging to a given VLAN. Resembling a layer 2 switch, the VFI is responsible for learning MAC addresses and providing loop-free forwarding of customer traffic to the appropriate end nodes. Each VPLS domain is identified by a globally unique VPN ID; hence, VFIs of the same VPLS domain must be configured with the same VPN ID on all participating PE routers. To guarantee traffic separation for all customer VLANs and that all packets are forwarded to the correct destination, the correct attachment circuits must be associated with the appropriate VFI, and each VFI must be associated to the unique VPN ID assigned to the customer VLAN. | ||||
| STIG | Date | |||
| Nokia Service Router OS 25.x Router Security Technical Implementation Guide | 2026-06-15 | |||
Details
Check Text (C-283826r1203727_chk)
Review the implementation plan and the Service IDs assigned to customer VLANs for the VPLS deployment.
Review the PE router configuration to verify customer attachment circuits (i.e., VLANs) are associated to the appropriate VFI. In the example below, the attached circuit at port 1/1/c5/1 is associated to Service ID 20.
Use the following command:
- show service id 20 base
Service Basic Information
Service Id : 20 Vpn Id : 20
Service Type : VPLS
—--- snip —---
-------------------------------------------------------------------------------
Service Access & Destination Points
-------------------------------------------------------------------------------
Identifier Type AdmMTU OprMTU Adm Opr
-------------------------------------------------------------------------------
sap:1/1/c5/1:100 q-tag 1518 1518 Up Up
sdp:30:20 M(3.3.3.3) Mesh 0 9190 Up Up
If the attachment circuits have not been bound to VFI configured with the assigned Service ID for each VLAN, this is a finding.
Fix Text (F-88296r1203726_fix)
Assign globally unique Service IDs for each customer VLAN using VPLS for carrier Ethernet services between multiple sites, and configure the attachment circuits to the appropriate VFI:
- configure service vpls 20 vpn 20 customer 1 create
- config>service>vpls# mesh-sdp 40:20 create
- config>service>vpls>mesh-sdp# exit
- config>service>vpls# sap 1/1/c5/1:100 create
- config>service>vpls>sap# exit
- config>service>vpls# no shutdown
- config>service>vpls# exit all