The Nokia Provider Edge (PE) router must be configured with Unicast Reverse Path Forwarding (uRPF) loose mode enabled on all Customer Edge (CE)-facing interfaces.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-283839 | NOKI-RT-000210 | SV-283839r1203766_rule | CCI-001097 | medium |
| Description | ||||
| The uRPF feature is a defense against spoofing and denial-of-service attacks by verifying if the source address of any ingress packet is reachable. To mitigate attacks that rely on forged source addresses, all PE routers must enable uRPF loose mode to guarantee that all packets received from a CE router contain source addresses that are in the route table. | ||||
| STIG | Date | |||
| Nokia Service Router OS 25.x Router Security Technical Implementation Guide | 2026-06-15 | |||
Details
Check Text (C-283839r1203766_chk)
Review the router configuration to determine if uRPF loose mode is enabled on all CE-facing interfaces, as shown in the example below.
Verify "uRPF Chk" is set to "enabled" and "uRPF Chk Mode" is set to "loose":
- show router interface "TO-CE" detail | match "uRPF Chk"
uRPF Chk : enabled uRPF Chk Mode : loose
If "uRPF Chk" is not enabled and "uRPF Chk Mode" is not set to "loose" on all CE-facing interfaces, this is a finding.
Fix Text (F-88309r1203765_fix)
Enable uRPF "loose" mode on all CE-facing interfaces, as shown in the example below:
- configure router interface "TO-CE" urpf-check mode loose