The Nokia router must be configured to have all inactive interfaces disabled.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-283903 | NOKI-RT-000920 | SV-283903r1203958_rule | CCI-001414 | low |
| Description | ||||
| An inactive interface is rarely monitored or controlled and may expose a network to an undetected attack on that interface. Unauthorized personnel with access to the communication facility could gain access to a router by connecting to a configured interface that is not in use. If an interface is no longer used, the configuration must be deleted and the interface disabled. For subinterfaces, delete subinterfaces that are on inactive interfaces and delete subinterfaces that are themselves inactive. If the subinterface is no longer necessary for authorized communications, it must be deleted. | ||||
| STIG | Date | |||
| Nokia Service Router OS 25.x Router Security Technical Implementation Guide | 2026-06-15 | |||
Details
Check Text (C-283903r1203958_chk)
Review the router configuration.
Verify the logical port is disabled using the command below:
show port 1/1/c2/1 | match "Admin State"
Admin State : down Oper Duplex : full
Verify the logical interface is disabled using the command below:
- show router interface "TO-PE2"
Interface Table (Router: Base)
Interface-Name Adm Opr(v4/v6) Mode Port/SapId
IP-Address PfxState
-------------------------------------------------------------------------------
TO-PE2 Down Down/Down Network 1/1/c1/1
172.22.21.2/30 n/a
2001:acad:1234:21::2/64 INACCESSIBLE
fe80::67:47f1:52a9:fb0c/64 INACCESSIBLE
-------------------------------------------------------------------------------
Interfaces : 1
If an interface is not being used but is configured or enabled, this is a finding.
Fix Text (F-88373r1203957_fix)
Delete inactive subinterfaces and disable and delete the configuration of any inactive ports on the router.
Disable inactive ports using the configuration below:
- configure port 1/1/c2/1 shutdown
Disable inactive logical interfaces using the configuration below:
- configure router interface "TO-PE2" shutdown