Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
The Cisco router must be configured to encrypt SNMP messages using a FIPS 140-2 approved algorithm.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-96319 | CISC-ND-001140 | SV-105457r1_rule | Medium |
| Description |
|---|
| Without the strong encryption that is provided by the SNMP Version 3 User-based Security Model (USM), an unauthorized user can gain access to network management information that can be used to create a network outage. |
| STIG | Date |
|---|---|
| Cisco IOS XE Router NDM Security Technical Implementation Guide | 2019-07-25 |
Details
| Check Text ( C-95155r1_chk ) |
|---|
| Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the example below. snmp-server group V3GROUP v3 priv read V3READ write V3WRITE snmp-server view V3READ iso included snmp-server view V3WRITE iso included snmp-server host x.x.x.x version 3 auth V3USER Encryption used by the SNMP users can be viewed via the show snmp user command as shown in the example below. R4#show snmp user User name: V3USER Engine ID: 800000090300C2042B540000 storage-type: nonvolatile active Authentication Protocol: SHA Privacy Protocol: AES256 Group-name: V3GROUP If the Cisco router is not configured to encrypt SNMP messages using a FIPS 140-2 approved algorithm, this is a finding. |
| Fix Text (F-101995r1_fix) |
|---|
| Configure the Cisco router to encrypt SNMP messages using a FIPS 140-2 approved algorithm as shown in the example below. R4(config)#snmp-server group V3GROUP v3 priv read V3READ write V3WRITE R4(config)#snmp-server user V3USER V3GROUP v3 auth sha xxxxxx priv aes 256 xxxxxx |