OpenControls Logo

STIG Viewer

STIGViewer Support

The Nokia Provider Edge (PE) router providing virtual private local area network services (VPLS) must be configured to have traffic broadcast storm thresholds on customer edge-facing interfaces.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-283910NOKI-RT-000990SV-283910r1203979_ruleCCI-001095medium
Description
A traffic storm occurs when packets flood a VPLS bridge, creating excessive traffic and degrading network performance. Traffic storm control prevents VPLS bridge disruption by suppressing traffic when the number of packets reaches configured threshold levels. Traffic storm control monitors incoming traffic levels on a port and drops traffic when the number of packets reaches the configured threshold level during any one-second interval.
STIGDate
Nokia Service Router OS 25.x Router Security Technical Implementation Guide2026-06-15

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CAP-02Resource Priority
0.50
CAP-03Capacity Planning
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (13) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(10)Authenticate Remote Commands
1.00
AC-17(9)Disconnect or Disable Access
1.00
AC-3Access Enforcement
1.00
AC-4Information Flow Enforcement
1.00
AU-3Content of Audit Records
1.00
CM-6Configuration Settings
1.00
CM-7Least Functionality
1.00
CM-7(2)Prevent Program Execution
1.00
SC-47Alternate Communications Paths
1.00
SC-5Denial-of-service Protection
1.00

+3 more (top 10 by confidence shown)

CCI1 mapping
CCI-001095
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.IR-04
0.50

Details

Check Text (C-283910r1203979_chk)

Review the router configuration to verify Quality-of-Service (QoS) SAP-ingress is applied on the service access point (SAP), deploying VPLS to control broadcast storm. Verify the QoS SAP-ingress policy is applied to the SAP using the configuration below: - show service id 20 sap 1/1/c7/1 qos | match "Ingress qos-policy" Ingress qos-policy : 100 Egress qos-policy : 1 If the QoS SAP-ingress is not applied to the SAP, this is a finding.

Fix Text (F-88380r1203978_fix)

Configure QoS SAP-ingress to control broadcast storm for each VPLS bridge domain. Base the suppression threshold on expected traffic rates plus some additional capacity. Configure QoS SAP-ingress using the example below: - configure qos sap-ingress 100 create - config>qos>sap-ingress# policer 10 create - config>qos>sap-ingress>policer# rate 12000 - config>qos>sap-ingress>policer# exit - config>qos>sap-ingress# fc "be" create - config>qos>sap-ingress>fc# broadcast-policer 10 - config>qos>sap-ingress>fc# exit - config>qos>sap-ingress# exit all Apply the QoS SAP-ingress policy to the SAP using the example below: - configure service vpls 20 sap 1/1/c7/1 ingress qos 100