The Nokia router must establish organization-defined alternate communications paths for system operations organizational command and control.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-283915 | NOKI-RT-001070 | SV-283915r1203994_rule | CCI-004931 | medium |
| Description | ||||
| An incident, whether adversarial or nonadversarial, can disrupt established communications paths used for system operations and organizational command and control. Alternate communications paths reduce the risk of all communications paths being affected by the same incident. To compound the problem, the inability of organizational officials to obtain timely information about disruptions or provide timely direction to operational elements after a communications path incident can impact the organization's ability to respond to such incidents in a timely manner. Establishing alternate communications paths for command and control purposes, including designating alternative decision makers if primary decision makers are unavailable and establishing the extent and limitations of their actions, can greatly facilitate the organization's ability to continue to operate and take appropriate actions during an incident. | ||||
| STIG | Date | |||
| Nokia Service Router OS 25.x Router Security Technical Implementation Guide | 2026-06-15 | |||
Details
Check Text (C-283915r1203994_chk)
There are several alternate communication paths to manage the device. The management port can be used as the first communication path for out-of-band access. The Virtual Private Routed Network (VPRN) service can be used as the second communication path for in-band access. The console port can be used as the third communication path for out-of-band access.
Verify the mgmt port address using the command below:
- show bof | match address
address 10.10.111.182/24 active
Verify that only the routes and interfaces belonging to the management VPRN are present using the command below:
- show router 30 route-table
Route Table (Service: 30)
Dest Prefix[Flags] Type Proto Age Pref
Next Hop[Interface Name] Metric
-------------------------------------------------------------------------------
172.x.x.x/30 Remote BGP VPN 00h07m10s 170
4.4.4.4 (tunneled:RSVP:1) 30
172.x.x.x/30 Local Local 00h20m51s 0
management-network 0
If the mgmt port address and mgmt network are not configured in the VPRN, this is the finding.
Fix Text (F-88385r1203993_fix)
Configure the mgmt port address for the out-of-band access using the example below:
- bof address 10.10.111.182/24
Configure the VPRN service for in-band management using the example below:
- configure service vprn 30 customer 1 create
- config>service>vprn# router-id 3.3.3.3
- config>service>vprn# autonomous-system 65100
- config>service>vprn# interface "management-network" create
- config>service>vprn>if# address 172.x.x.x/30
- config>service>vprn>if# sap 1/1/c3/1 create
- config>service>vprn>if>sap# exit
- config>service>vprn>if# exit
- config>service>vprn# bgp-ipvpn
- config>service>vprn>bgp-ipvpn# mpls
- config>service>vprn>bgp-ipvpn>mpls# auto-bind-tunnel
- config>service>vprn>bgp-ipvpn>mpls>auto-bind-tunnel# resolution any
- config>service>vprn>bgp-ipvpn>mpls>auto-bind-tunnel# exit
- config>service>vprn>bgp-ipvpn>mpls# route-distinguisher x.x.x.x:x
- config>service>vprn>bgp-ipvpn>mpls# vrf-target target:x:x
- config>service>vprn>bgp-ipvpn>mpls# no shutdown
- config>service>vprn>bgp-ipvpn>mpls# exit
- config>service>vprn>bgp-ipvpn# exit
- config>service>vprn# no shutdown