The Nokia Provider Edge (PE) router must be configured to have each Virtual Routing and Forwarding (VRF) instance with the appropriate Route Target (RT).
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-283844 | NOKI-RT-000260 | SV-283844r1203781_rule | CCI-000366 | high |
| Description | ||||
| The primary security model for a Multiprotocol Label Switching (MPLS) Layer 3 virtual private network (L3VPN), as well as a VRF-lite infrastructure, is traffic separation. Each interface can be associated to only one VRF, which is the fundamental framework for traffic separation. Forwarding decisions are made based on the routing table belonging to the VRF. Control of what routes are imported into or exported from a VRF is based on the RT. It is critical that traffic does not leak from one Community of Interest tenant or L3VPN to another; hence, it is imperative that the correct RT is configured for each VRF. | ||||
| STIG | Date | |||
| Nokia Service Router OS 25.x Router Security Technical Implementation Guide | 2026-06-15 | |||
Details
Check Text (C-283844r1203781_chk)
Verify the correct RT is configured for each VRF.
Review the design plan for MPLS/L3VPN and VRF-lite to determine what RTs have been assigned for each VRF.
Use the command below to verify "Vrf Target" fields:
- show service id 30 base | match "Vrf Target"
Vrf Target : target:65100:30
If any VRFs are configured with the wrong RT, this is a finding.
Fix Text (F-88314r1203780_fix)
Configure all PE routers to have the correct VRF defined with the appropriate RT, as shown in the example below:
- configure service vprn 30 customer 1 create
- config>service>vprn# bgp-ipvpn mpls vrf-target target:65100:30
- config>service>vprn# bgp-ipvpn mpls no shutdown