← Back to Nokia Service Router OS 25.x Network Device Management Security Technical Implementation Guide

V-283792

CAT II (Medium)

The Nokia router must be configured to protect nonlocal maintenance sessions by separating the maintenance session from other network sessions within the system by logically separated communications paths.

Rule ID

SV-283792r1203421_rule

STIG

Nokia Service Router OS 25.x Network Device Management Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-004192

Discussion

Nonlocal maintenance and diagnostic activities are conducted by individuals who communicate through an external or internal network. Communications paths can be logically separated using encryption.

Check Content

Verify the out-of-band management IP address and static-routes are configured:

-  show bof

    primary-image    cf3:\TiMOS-SR-24.10.R5
    primary-config   cf3:\config.cfg
    secondary-image  cf3:\TiMOS-SR-24.3.R3
    license-file     cf3:\license-xma.txt
    address          10.1.0.156/24 active
    address          10.1.0.157/24 standby
    static-route     0.0.0.0/1 next-hop 10.1.0.1
    static-route     128.0.0.0/1 next-hop 10.1.0.1

If the out-of-band management IP address and static-routes are not configured, this is a finding.

Fix Text

Configure the out-of-band management session using the management port.

Assign an IP address to the management port:

- bof address <ip address>

Configure any static-routes needed:

- bof static-route <ip prefix/mask> next-hop <ip address>