The Nokia Multiprotocol Label Switching (MPLS) router must be configured to have time-to-live (TTL) propagation disabled.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-283854 | NOKI-RT-000360 | SV-283854r1203811_rule | CCI-000366 | medium |
| Description | ||||
| The head end of the label-switched path (LSP), the label edge router (LER) will decrement the IP packet's TTL value by one and then copy the value to the MPLS TTL field. At each label-switched router (LSR) hop, the MPLS TTL value is decremented by one. The MPLS router that pops the label (either the penultimate LSR or the egress LER) will copy the packet's MPLS TTL value to the IP TTL field and decrement it by one. This TTL propagation is the default behavior. Because the MPLS TTL is propagated from the IP TTL, a traceroute will list every hop in the path, whether routed or label switched, thereby exposing core nodes. With TTL propagation disabled, LER decrements the IP packet's TTL value by one and then places a value of 255 in the packet's MPLS TTL field. This is then decremented by one as the packet passes through each LSR in the MPLS core. Because the MPLS TTL never drops to zero, none of the LSP hops triggers an ICMP TTL exceeded message. Consequently, these hops are not recorded in a traceroute, and nodes within the MPLS core cannot be discovered by an attacker. | ||||
| STIG | Date | |||
| Nokia Service Router OS 25.x Router Security Technical Implementation Guide | 2026-06-15 | |||
Details
Check Text (C-283854r1203811_chk)
Review the router configuration to verify TTL propagation is disabled.
Use the command below to verify "Local TTL Prop" and/or "Transit TTL Prop" has been disabled:
- show router mpls status | match "TTL Prop"
Local TTL Prop : Disabled Transit TTL Prop : Disabled
If the router is not configured to disable TTL propagation, this is a finding.
Fix Text (F-88324r1203810_fix)
Disable the propagation of the TTL for locally generated packets and transit packets for all LSP shortcuts originating on this ingress LER, as shown in the configuration below:
- configure router mpls no shortcut-local-ttl-propagate
- configure router mpls no shortcut-transit-ttl-propagate