The Nokia router must implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-283859 | NOKI-RT-000410 | SV-283859r1203826_rule | CCI-004891 | medium |
| Description | ||||
| Separating critical system components and functions from other noncritical system components and functions through separate subnetworks may be necessary to reduce susceptibility to a catastrophic or debilitating breach or compromise that results in system failure. For example, physically separating the command and control function from the in-flight entertainment function through separate subnetworks in a commercial aircraft provides an increased level of assurance in the trustworthiness of critical system functions. | ||||
| STIG | Date | |||
| Nokia Service Router OS 25.x Router Security Technical Implementation Guide | 2026-06-15 | |||
Details
Check Text (C-283859r1203826_chk)
Verify the router is configured to implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.
Verify the Virtual Private Routed Network (VPRN) service information, as shown in the example below:
- show service id 30 base
Service Basic Information
Service Id : 30 Vpn Id : 0
Service Type : VPRN
MACSec enabled : no
Name : 30
Description : (Not Specified)
Customer Id : 1 Creation Origin : manual
Last Status Change: 12/11/2025 17:17:26
Last Mgmt Change : 12/11/2025 17:17:26
Admin State : Up Oper State : Up
Router Oper State : Up
Route Dist. : 3.3.3.3:30 VPRN Type : regular
Oper Route Dist : 3.3.3.3:30
Oper RD Type : configured
AS Number : 65100 Router Id : 3.3.3.3
ECMP : Enabled ECMP Max Routes : 1
Max IPv4 Routes : No Limit
Local Rt Domain-Id: None D-Path Lng Ignore : Disabled
Auto Bind Tunnel
Allow Flex-Alg-Fb : Disabled
Resolution : any
Weighted ECMP : Disabled ECMP Max Routes : 1
Strict Tnl Tag : Disabled
Max IPv6 Routes : No Limit
Ignore NH Metric : Disabled
Hash Label : Disabled
Entropy Label : Disabled
Vrf Target : target:65100:30
Vrf Import : None
Vrf Export : None
MVPN Vrf Target : None
MVPN Vrf Import : None
MVPN Vrf Export : None
Car. Sup C-VPN : Disabled
Label mode : vrf
BGP VPN Backup : Disabled
BGP Export Inactv : Disabled
LOG all events : Disabled
SAP Count : 1 SDP Bind Count : 0
-------------------------------------------------------------------------------
Service Access & Destination Points
-------------------------------------------------------------------------------
Identifier Type AdmMTU OprMTU Adm Opr
-------------------------------------------------------------------------------
sap:1/1/c5/1 null 1514 1514 Up Up
If the router is not configured to implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions, this is a finding.
Fix Text (F-88329r1203825_fix)
Configure the router to implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.
Configure logically separate subnetworks by configuring the VPRN service, as shown in the example below:
- configure service vprn 30 customer 1 create
- config>service>vprn# router-id 3.3.3.3
- config>service>vprn# autonomous-system 65100
- config>service>vprn# interface "TO-CE" create
- config>service>vprn>if# address 172.10.10.1/24
- config>service>vprn>if# sap 1/1/c5/1 create
- config>service>vprn>if>sap# exit
- config>service>vprn>if# exit
- config>service>vprn# bgp-ipvpn
- config>service>vprn>bgp-ipvpn# mpls
- config>service>vprn>bgp-ipvpn>mpls# auto-bind-tunnel resolution any
- config>service>vprn>bgp-ipvpn>mpls# route-distinguisher 3.3.3.3:30
- config>service>vprn>bgp-ipvpn>mpls# vrf-target target:65100:30
- config>service>vprn>bgp-ipvpn>mpls# no shutdown
- config>service>vprn>bgp-ipvpn>mpls# exit
- config>service>vprn>bgp-ipvpn# exit
- config>service>vprn# exit all