The Nokia perimeter router must be configured to drop IPv6 packets containing the network service access point (NSAP) address option within the Destination Option header.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-283847 | NOKI-RT-000290 | SV-283847r1203790_rule | CCI-002403 | medium |
| Description | ||||
| The optional and extensible natures of the IPv6 extension headers require higher scrutiny since many implementations do not always drop packets with headers they cannot recognize, and hence could cause a denial of service on the target device. In addition, the type, length, value (TLV) formatting enables headers to be very large. This option type from RFC 1888 (Open Systems Interconnection [OSI] NSAPs and IPv6) has been deprecated by RFC 4048. | ||||
| STIG | Date | |||
| Nokia Service Router OS 25.x Router Security Technical Implementation Guide | 2026-06-15 | |||
Details
Check Text (C-283847r1203790_chk)
This requirement is not applicable for the DODIN Backbone.
Review the router configuration and determine if filters are bound to the applicable interfaces to drop IPv6 packets containing a Destination Option header with option type value of 0xC3 (NSAP address).
Verify the IPv6 filter has the Next Header value set to "60", as shown in the example below:
- show filter ipv6 40
Entry : 10
Description : (Not Specified)
Log Id : n/a
Src. IP : ::/0
Src. Port : n/a
Dest. IP : ::/0
Dest. Port : n/a
Next Header : 60
Verify an "Ing IPv6 Flt" has been applied to the interface, as shown in the example below:
- show router interface "TO-PE2" detail | match "Ingr IPv6 Flt"
Egr IPv6 Flt : none Ingr IPv6 Flt : 40
If the router is not configured to drop IPv6 packets containing the NSAP address option within the Destination Option header, this is a finding.
Fix Text (F-88317r1203789_fix)
Configure the router to drop IPv6 packets containing a Destination Option header with the option type value of 0xC3 (NSAP address).
Configure an IPv6 filter:
- config>filter# ipv6-filter 40 create
- config>filter>ipv6-filter# entry 10 create
- config>filter>ipv6-filter>entry# match next-header 60
- config>filter>ipv6-filter>entry>match# back
- config>filter>ipv6-filter>entry# action drop
- config>filter>ipv6-filter>entry# exit all
Apply the IPv6 filter to the interface:
- configure router interface "TO-PE2" ingress filter ipv6 40