The Nokia Provider Edge (PE) router must be configured to have each Virtual Routing and Forwarding (VRF) instance with the appropriate Route Distinguisher (RD).
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-283901 | NOKI-RT-000900 | SV-283901r1203952_rule | CCI-000366 | medium |
| Description | ||||
| An RD provides uniqueness to the customer address spaces within the Multiprotocol Label Switching (MPLS) layer 3 virtual private network (L3VPN) infrastructure. The concept of the VPN-IPv4 and VPN-IPv6 address families consists of the RD prepended before the IP address. If the same IP prefix is used in several different L3VPNs, it is possible for Border Gateway Protocol (BGP) to carry several completely different routes for that prefix, one for each VPN. Because VPN-IPv4 addresses and IPv4 addresses are different address families, BGP never treats them as comparable addresses. The purpose of the RD is to create distinct routes for common IPv4 address prefixes. On any given PE router, a single RD can define a VRF in which the entire address space may be used independently, regardless of the makeup of other VPN address spaces. Hence, it is imperative that a unique RD is assigned to each L3VPN and the proper RD is configured for each VRF. | ||||
| STIG | Date | |||
| Nokia Service Router OS 25.x Router Security Technical Implementation Guide | 2026-06-15 | |||
Details
Check Text (C-283901r1203952_chk)
Review the RDs that have been assigned for each VRF according to the plan provided by the information system security manager (ISSM).
Review all VRFs configured on CE-facing interfaces and verify the proper RD has been configured for each.
Verify the "Route Dist." value for each service using the command below:
- show service id 30 base | match "Route Dist"
Route Dist. : 3.3.3.3:30 VPRN Type : regular
Oper Route Dist : 3.3.3.3:30
If the wrong RD has been configured for any VRF, this is a finding.
Fix Text (F-88371r1203951_fix)
Configure the correct RD for each VRF.
Use one of the commands below to configure the RD based on the architecture. RD ID uses the format as number: common value:
- configure service vprn 30 customer 1 bgp-ipvpn mpls route-distinguisher 3.3.3.3:30
- configure service vprn 30 customer 1 bgp-ipvpn mpls no shutdown