← Back to Nokia Service Router OS 25.x Router Security Technical Implementation Guide

V-283861

CAT II (Medium)

The Nokia router must be configured to have Address Resolution Protocol (ARP) Learn Unsolicited disabled on all external interfaces.

Rule ID

SV-283861r1203832_rule

STIG

Nokia Service Router OS 25.x Router Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-002385

Discussion

ARP Learn Unsolicited is an ARP broadcast in which the source and destination MAC addresses are the same. It is used to inform the network about a host IP address. A spoofed ARP Learn Unsolicited message can cause network mapping information to be stored incorrectly, causing network malfunction.

Check Content

Review the configuration to determine if ARP Learn Unsolicited is disabled on all external interfaces.

Use the command below to verify the "ARP Learn Unsoli*" field for each configured interface is "Disabled":

- show router interface "TO-CE" detail | match "ARP Learn Unsoli*"
ARP Learn Unsoli*: Disabled             ND Learn Unsolici*: None

If  ARP Learn Unsolicited is enabled on any external interface, this is a finding.

Fix Text

Disable ARP Learn Unsolicited on all external interfaces, as shown in the example below: 

- configure router interface "TO-PE2" no arp-learn-unsolicited

Note: By default, arp-learn-unsolicited is disabled to deny GARP messages.