The Nokia perimeter router must be configured to block all outbound management traffic.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-283892 | NOKI-RT-000770 | SV-283892r1203925_rule | CCI-002403 | medium |
| Description | ||||
| For in-band management, the management network must have its own subnet to enforce control and access boundaries provided by layer 3 network nodes, such as routers and firewalls. Management traffic between the managed network elements and the management network is routed via the same links and nodes that are used for production or operational traffic. Safeguards must be implemented to ensure the management traffic does not leak past the perimeter of the managed network. | ||||
| STIG | Date | |||
| Nokia Service Router OS 25.x Router Security Technical Implementation Guide | 2026-06-15 | |||
Details
Check Text (C-283892r1203925_chk)
This requirement is not applicable for the DODIN Backbone.
The perimeter router of the managed network must be configured with an access control list (ACL) or filter on the egress interface to block all management traffic.
Verify IPv4 and IPv6 filters are applied on the interface using the commands below:
- show router interface "TO-PE2" detail | match "Egress Filter"
Egress Filter : 10 Ingress Filter : 10
- show router interface "TO-PE2" detail | match "Egr IPv6 Flt"
Egr IPv6 Flt : 20 Ingr IPv6 Flt : none
If management traffic is not blocked at the perimeter, this is a finding.
Fix Text (F-88362r1203924_fix)
This requirement is not applicable for the DODIN Backbone.
Configure the perimeter router of the managed network with IPv4 and IPv6 filters on the egress interface to block all outbound management traffic using the example below:
Create an IPv4 filter:
- configure filter ip-filter 10
- config>filter>ip-filter# entry 10
- config>filter>ip-filter# entry 10 create
- config>filter>ip-filter>entry$ match dst-ip 172.10.1.0/24
- config>filter>ip-filter>entry$ action drop
- config>filter>ip-filter>entry$ exit
- config>filter>ip-filter# default-action forward
- config>filter>ip-filter# exit all
Create an IPv6 filter:
- configure filter ipv6-filter 20 create
- config>filter>ipv6-filter$ entry 10 create
- config>filter>ipv6-filter>entry$ match dst-ip 2001:acad:1234:200::1/64
- config>filter>ipv6-filter>entry$ action drop
- config>filter>ipv6-filter>entry$ exit
- config>filter>ipv6-filter$ default-action forward
- config>filter>ipv6-filter$ exit all
Apply the IPv4 filter and IPv6 filter on the interface:
- configure router interface "TO-PE2" egress filter ip 10
- configure router interface "TO-PE2" egress filter ipv6 20