OpenControls Logo

STIG Viewer

STIGViewer Support

The Nokia perimeter router must be configured to block all outbound management traffic.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-283892NOKI-RT-000770SV-283892r1203925_ruleCCI-002403medium
Description
For in-band management, the management network must have its own subnet to enforce control and access boundaries provided by layer 3 network nodes, such as routers and firewalls. Management traffic between the managed network elements and the management network is routed via the same links and nodes that are used for production or operational traffic. Safeguards must be implemented to ensure the management traffic does not leak past the perimeter of the managed network.
STIGDate
Nokia Service Router OS 25.x Router Security Technical Implementation Guide2026-06-15

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

NET-03Boundary Protection
0.50
NET-04.1Deny Traffic by Default & Allow Traffic by Exception
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (8) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CM-6Configuration Settings
1.00
SC-24Fail in Known State
1.00
SC-47Alternate Communications Paths
1.00
SC-5Denial-of-service Protection
1.00
SC-7Boundary Protection
1.00
SC-7(11)Restrict Incoming Communications Traffic
1.00
SC-7(29)Separate Subnets to Isolate Functions
1.00
SC-7(5)Deny by Default — Allow by Exception
1.00
CCI1 mapping
CCI-002403
1.00

Details

Check Text (C-283892r1203925_chk)

This requirement is not applicable for the DODIN Backbone. The perimeter router of the managed network must be configured with an access control list (ACL) or filter on the egress interface to block all management traffic. Verify IPv4 and IPv6 filters are applied on the interface using the commands below: - show router interface "TO-PE2" detail | match "Egress Filter" Egress Filter : 10 Ingress Filter : 10 - show router interface "TO-PE2" detail | match "Egr IPv6 Flt" Egr IPv6 Flt : 20 Ingr IPv6 Flt : none If management traffic is not blocked at the perimeter, this is a finding.

Fix Text (F-88362r1203924_fix)

This requirement is not applicable for the DODIN Backbone. Configure the perimeter router of the managed network with IPv4 and IPv6 filters on the egress interface to block all outbound management traffic using the example below: Create an IPv4 filter: - configure filter ip-filter 10 - config>filter>ip-filter# entry 10 - config>filter>ip-filter# entry 10 create - config>filter>ip-filter>entry$ match dst-ip 172.10.1.0/24 - config>filter>ip-filter>entry$ action drop - config>filter>ip-filter>entry$ exit - config>filter>ip-filter# default-action forward - config>filter>ip-filter# exit all Create an IPv6 filter: - configure filter ipv6-filter 20 create - config>filter>ipv6-filter$ entry 10 create - config>filter>ipv6-filter>entry$ match dst-ip 2001:acad:1234:200::1/64 - config>filter>ipv6-filter>entry$ action drop - config>filter>ipv6-filter>entry$ exit - config>filter>ipv6-filter$ default-action forward - config>filter>ipv6-filter$ exit all Apply the IPv4 filter and IPv6 filter on the interface: - configure router interface "TO-PE2" egress filter ip 10 - configure router interface "TO-PE2" egress filter ipv6 20