The Nokia perimeter router must be configured to have Link Layer Discovery Protocols (LLDPs) disabled on all external interfaces and ensure LLDPs are not included in the system level.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-283877 | NOKI-RT-000590 | SV-283877r1203880_rule | CCI-002403 | low |
| Description | ||||
| LLDPs are primarily used to obtain protocol addresses of neighboring devices and discover platform capabilities of those devices. Use of Simple Network Management Protocol (SNMP) with the LLDP Management Information Base (MIB) allows network management applications to learn the device type and the SNMP agent address of neighboring devices, enabling the application to send SNMP queries to those devices. LLDPs are also media and protocol independent as they run over the data link layer; therefore, two systems that support different network-layer protocols can still learn about each other. Allowing LLDP messages to reach external network nodes is dangerous as it provides an attacker a method to obtain information about the network infrastructure that can be useful to plan an attack. | ||||
| STIG | Date | |||
| Nokia Service Router OS 25.x Router Security Technical Implementation Guide | 2026-06-15 | |||
Details
Check Text (C-283877r1203880_chk)
This requirement is not applicable for the DODIN Backbone.
Review all router configurations to ensure LLDPs are not included in the global configuration or LLDPs are not included for each active external interface.
Verify LLDP "Admin Enabled" sis et to "False" in the system level using the command below:
- show system lldp | match "Admin Enabled"
Admin Enabled : False
Verify LLDP is in "Admin State" and set to "disabled" for all active external ports using the command below:
- show port 1/1/c2/1 ethernet lldp | match "Admin State"
Admin State : disabled Notifications : Disabled
Admin State : disabled Notifications : Disabled
Admin State : disabled Notifications : Disabled
If LLDPs are configured on the system and any external interface, this is a finding.
Fix Text (F-88347r1203879_fix)
This requirement is not applicable for the DODIN Backbone.
Disable LLDP on the system level using the command below:
- configure system lldp shutdown
Disable LLDP on the port using the command below:
- configure port 1/1/c2/1
- config>port# ethernet lldp dest-mac nearest-bridge admin-status disabled
- config>port# exit all