The Nokia layer 2 switch must implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions.

Separating critical system components and functions from other noncritical system components and functions through separate subnetworks may be necessary to reduce susceptibility to a catastrophic or debilitating breach or compromise that results in system failure. For example, physically separating the command and control function from the in-flight entertainment function through separate subnetworks in a commercial aircraft provides an increased level of assurance in the trustworthiness of critical system functions.

Verify the layer 2 switch is configured to implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions. Logical layer 2 switch separation is configured using separate virtual private local area network services (VPLS). Verify VPLS services created and access ports configured for each VPLS service using the commands below. To view all the VPLS services created, use the following command: - show service service-using vpls Services [vpls] =============================================================================== ServiceId Type Adm Opr CustomerId Service Name ------------------------------------------------------------------------------- 200 VPLS Up Up 1 200 300 VPLS Up Up 1 300 Use the command below to view all the access points that are part of each VPLS service: - show service id 200 base | match sap sap:1/1/c1/1:200 q-tag 1518 1518 Up Up If the layer 2 switch is not configured to implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions, this is a finding.

Configure the layer 2 switch to implement physically or logically separate subnetworks to isolate organization-defined critical system components and functions. A layer 2 switch VPLS service is a logically separate subnetwork. Configure a VPLS service using the following commands: - configure service vpls <vpls service id> customer <customer id> create - sap <port id:vlan tag if needed> create - back Add as many service access point (SAP) access ports as needed. If connection to a remote site is needed, add a service distribution point (SDP) tunnel to the remote endpoint: - spoke-sdp: <sdp id>:<vc id> create - back - no shutdown