The Nokia router must be configured to log all packets that have been dropped.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-283898 | NOKI-RT-000870 | SV-283898r1203943_rule | CCI-000134 | low |
| Description | ||||
| Auditing and logging are key components of any security architecture. Security personnel must know what is being done or attempted to be done, and by whom, to compile an accurate risk assessment. Auditing the actions on network devices provides a means to recreate an attack or identify a configuration mistake on the device. | ||||
| STIG | Date | |||
| Nokia Service Router OS 25.x Router Security Technical Implementation Guide | 2026-06-15 | |||
Details
Check Text (C-283898r1203943_chk)
Review the IP filter to verify all deny statements are logged.
Use the commands below to verify the filter is logged and applied on the interface.
- show filter ip 60
Entry : 10
Description : (Not Specified)
Log Id : 101
Src. IP : 0.0.0.0/0
Src. Port : n/a
Dest. IP : 0.0.0.0/0
Dest. Port : n/a
Protocol : Undefined
Dscp : Undefined
ICMP Type : Undefined ICMP Code : Undefined
Fragment : Off Src Route Opt : Off
Sampling : Off Int. Sampling : On
IP-Option : 0/0 Multiple Option: Off
Tcp-flag : (Not Specified)
Option-pres : Off
Egress PBR : Disabled
Primary Action : Drop
Ing. Matches : 0 pkts
Egr. Matches : 0 pkts
- show router interface "TO-PE2" detail | match "Ingress Filter"
Egress Filter : 10 Ingress Filter : 10
If packets being dropped are not logged and a filter is not applied, this is a finding.
Fix Text (F-88368r1203942_fix)
Configure an IP filter to log all deny statements using the example below:
Create an IP filter:
- configure filter ip-filter 60 create
- config>filter>ip-filter$ entry 10 create
- config>filter>ip-filter>entry$ action drop
- config>filter>ip-filter>entry$ log 101
- config>filter>ip-filter>entry$ exit
- config>filter>ip-filter$ exit all
Apply the IP filter on the interface:
- configure router interface "TO-PE2" ingress filter ip 10