The Nokia out-of-band management (OOBM) gateway router must be configured to block any traffic destined to itself that is not sourced from the OOBM network or the Network Operations Center (NOC).
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-283887 | NOKI-RT-000710 | SV-283887r1203910_rule | CCI-001097 | medium |
| Description | ||||
| If the gateway router is not a dedicated device for the OOBM network, several safeguards must be implemented for containment of management and production traffic boundaries. It is imperative that hosts from the managed network are not able to access the OOBM gateway router. | ||||
| STIG | Date | |||
| Nokia Service Router OS 25.x Router Security Technical Implementation Guide | 2026-06-15 | |||
Details
Check Text (C-283887r1203910_chk)
This requirement is not applicable for the DODIN Backbone.
Review the CPM filter for the router receive path using the example below:
- show system security cpm-filter ip-filter entry 10
CPM IP Filter Entry
Entry Id : 10
Description : (Not Specified)
-------------------------------------------------------------------------------
Filter Entry Match Criteria :
-------------------------------------------------------------------------------
Log Id : n/a
Src. IP : 192.168.50.0/24
Src. Port : n/a
Dst. IP : n/a
Dest. Port : n/a
Protocol : none Dscp : Undefined
ICMP Type : Undefined ICMP Code : Undefined
Fragment : Off Option-present : Off
IP-Option : n/a Multiple Option : Off
TCP-syn : Off TCP-ack : Off
Action : Forward
Match Router ID : n/a
Dropped pkts : 0 Forwarded pkts : 0
If the CPM filter is not configured to only allow traffic to the route processor from the OOBM local area network (LAN), this is a finding.
Fix Text (F-88357r1203909_fix)
This requirement is not applicable for the DODIN Backbone.
Configure cpm-filter using the example below:
- configure system security cpm-filter
- config>sys>security>cpm-filter# default-action drop
- config>sys>security>cpm-filter# ip-filter
- config>sys>sec>cpm>ip-filter# entry 10 create
- cfg>sys>sec>cpm>ip-filter>entry# match src-ip 192.168.50.0/24
- cfg>sys>sec>cpm>ip-filter>entry# action accept
- cfg>sys>sec>cpm>ip-filter>entry# exit
- config>sys>sec>cpm>ip-filter# no shutdown
- config>sys>sec>cpm>ip-filter# exit all