The Nokia Provider Edge (PE) router must be configured to enforce a Quality-of-Service (QoS) policy to limit the effects of packet flooding denial-of-service (DoS) attacks.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-283894 | NOKI-RT-000800 | SV-283894r1203931_rule | CCI-001095 | medium |
| Description | ||||
| DoS is a condition when a resource is not available for legitimate users. Packet flooding distributed denial-of-service (DDoS) attacks are referred to as volumetric attacks and have the objective of overloading a network or circuit to deny or seriously degrade performance, which denies access to the services that normally traverse the network or circuit. Volumetric attacks have become relatively easy to launch using readily available tools such as Low Orbit Ion Cannon or botnets. Measures to mitigate the effects of a successful volumetric attack must be taken to ensure that sufficient capacity is available for mission-critical traffic. Managing capacity may include, for example, establishing selected network usage priorities or quotas and enforcing them using rate limiting, QoS, or other resource reservation control methods. These measures may also mitigate the effects of sudden decreases in network capacity that are the result of accidental or intentional physical damage to telecommunications facilities (such as cable cuts or weather-related outages). Satisfies: SRG-NET-000193-RTR-000112, SRG-NET-000193-RTR-000114, SRG-NET-000193-RTR-000113 | ||||
| STIG | Date | |||
| Nokia Service Router OS 25.x Router Security Technical Implementation Guide | 2026-06-15 | |||
Details
Check Text (C-283894r1203931_chk)
Review the router configuration and interview the system administrator to verify a mechanism for traffic prioritization and bandwidth reservation exists.
This arrangement must ensure that sufficient capacity is available for mission-critical traffic and enforce the traffic priorities specified by the Combatant Commands/Services/Agencies.
Verify QoS scheduler policy and service access point (SAP)-ingress policies are applied on the service access point using the command below:
- show service id 10 sap 1/1/c7/1 detail | match QOS post-lines 6
QOS
-------------------------------------------------------------------------------
Ingress qos-policy : 90 Egress qos-policy : 1
Ingress FP QGrp : (none) Egress Port QGrp : (none)
Ing FP QGrp Inst : (none) Egr Port QGrp Inst: (none)
Ing ip-match tag : none Ing ipv6-match tag: none
I. Sched Pol : TEST
If QoS scheduler-policy and SAP-ingress are not configured, this is a finding.
Fix Text (F-88364r1203930_fix)
Implement a mechanism for traffic prioritization and bandwidth reservation. This mechanism must enforce the traffic priorities specified by the Combatant Commands/Services/Agencies.
Nokia routers support multiple QoS policy types. Below is an example of how to configure and apply the SAP Ingress QoS policy.
Configure scheduler-policy using the example below:
- configure qos scheduler-policy TEST create
- config>qos>scheduler-policy$ tier 1
- config>qos>scheduler-policy>tier$ scheduler root create
- config>qos>scheduler-policy>tier>scheduler$ rate 107520 cir 107520
- config>qos>scheduler-policy>tier>scheduler$ exit
- config>qos>scheduler-policy>tier$ exit all
Configure QoS sap-ingress policy using the example below:
- configure qos sap-ingress 90 create
- config>qos>sap-ingress# queue 1 create
- config>qos>sap-ingress>queue# parent "root" cir-level 1
- config>qos>sap-ingress>queue# adaptation-rule pir max cir min
- config>qos>sap-ingress>queue# rate 107520 cir 40960
- config>qos>sap-ingress>queue# mbs 135 kilobytes
-config>qos>sap-ingress>queue# cbs 52
-config>qos>sap-ingress>queue# exit
-config>qos>sap-ingress# queue 2 create
-config>qos>sap-ingress>queue$ parent "root" level 2 cir-level 2
-config>qos>sap-ingress>queue$ adaptation-rule pir max cir min
-config>qos>sap-ingress>queue$ rate 107520 cir 10240
-config>qos>sap-ingress>queue$ mbs 135 kilobytes
-config>qos>sap-ingress>queue$ cbs 13
-config>qos>sap-ingress>queue$ exit
-config>qos>sap-ingress# queue 3 create
-config>qos>sap-ingress>queue$ parent "root" level 3 cir-level 3
-config>qos>sap-ingress>queue$ adaptation-rule pir max cir min
-config>qos>sap-ingress>queue$ rate 107520 cir 10240
-config>qos>sap-ingress>queue$ mbs 135 kilobytes
-config>qos>sap-ingress>queue$ cbs 13
-config>qos>sap-ingress>queue$ exit
-config>qos>sap-ingress# queue 4 create
-config>qos>sap-ingress>queue$ parent "root" level 4 cir-level 4
-config>qos>sap-ingress>queue$ adaptation-rule pir max cir min
-config>qos>sap-ingress>queue$ rate 40960 cir 40960
-config>qos>sap-ingress>queue$ mbs 52 kilobytes
-config>qos>sap-ingress>queue$ cbs 52
-config>qos>sap-ingress>queue$ exit
-config>qos>sap-ingress# queue 11 multipoint create
-config>qos>sap-ingress>queue# parent "root" cir-level 1
-config>qos>sap-ingress>queue# adaptation-rule pir max cir min
-config>qos>sap-ingress>queue# rate 20480 cir 5120
-config>qos>sap-ingress>queue# exit
-config>qos>sap-ingress# fc af create
-config>qos>sap-ingress>fc$ queue 3
-config>qos>sap-ingress>fc$ exit
-config>qos>sap-ingress# fc be create
-config>qos>sap-ingress>fc$ queue 1
-config>qos>sap-ingress>fc$ exit
-config>qos>sap-ingress# fc l1 create
-config>qos>sap-ingress>fc$ queue 4
-config>qos>sap-ingress>fc$ exit
-config>qos>sap-ingress# fc l2 create
-config>qos>sap-ingress>fc$ queue 2
-config>qos>sap-ingress>fc$ exit
-config>qos>sap-ingress# dscp "ef" fc l1
-config>qos>sap-ingress# dscp "cp9" fc l2
-config>qos>sap-ingress# dscp "af11" fc af
-config>qos>sap-ingress# exit all
Apply scheduler policy using the example below:
- configure service epipe 10 sap 1/1/c7/1 ingress scheduler-policy "TEST"
Apply QoS policy using the example below:
- configure service epipe 10 sap 1/1/c7/1 ingress qos 90