The Nokia router must be configured to have Address Resolution Protocol (ARP) Learn Unsolicited disabled on all external interfaces.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-283861 | NOKI-RT-000430 | SV-283861r1203832_rule | CCI-002385 | medium |
| Description | ||||
| ARP Learn Unsolicited is an ARP broadcast in which the source and destination MAC addresses are the same. It is used to inform the network about a host IP address. A spoofed ARP Learn Unsolicited message can cause network mapping information to be stored incorrectly, causing network malfunction. | ||||
| STIG | Date | |||
| Nokia Service Router OS 25.x Router Security Technical Implementation Guide | 2026-06-15 | |||
Details
Check Text (C-283861r1203832_chk)
Review the configuration to determine if ARP Learn Unsolicited is disabled on all external interfaces.
Use the command below to verify the "ARP Learn Unsoli*" field for each configured interface is "Disabled":
- show router interface "TO-CE" detail | match "ARP Learn Unsoli*"
ARP Learn Unsoli*: Disabled ND Learn Unsolici*: None
If ARP Learn Unsolicited is enabled on any external interface, this is a finding.
Fix Text (F-88331r1203831_fix)
Disable ARP Learn Unsolicited on all external interfaces, as shown in the example below:
- configure router interface "TO-PE2" no arp-learn-unsolicited
Note: By default, arp-learn-unsolicited is disabled to deny GARP messages.