Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
The Cisco router must be configured to encrypt SNMP messages using a FIPS 140-2 approved algorithm.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-216539 | CISC-ND-001140 | SV-216539r879768_rule | Medium |
| Description |
|---|
| Without the strong encryption that is provided by the SNMP Version 3 User-based Security Model (USM), an unauthorized user can gain access to network management information that can be used to create a network outage. |
| STIG | Date |
|---|---|
| Cisco IOS XR Router NDM Security Technical Implementation Guide | 2023-09-18 |
Details
| Check Text ( C-17774r288303_chk ) |
|---|
| Review the Cisco router configuration to verify that it is compliant with this requirement as shown in the example below. snmp-server host x.x.x.x traps version 3 auth V3USER snmp-server user V3USER V3GROUP v3 auth sha encrypted 110B1607150B snmp-server view V3READ iso included snmp-server view V3WRITE iso included snmp-server group V3GROUP v3 auth read V3READ write V3WRITE If the Cisco router is not configured to encrypt SNMP messages using a FIPS 140-2 approved algorithm, this is a finding. |
| Fix Text (F-17771r288304_fix) |
|---|
| Configure the Cisco router to encrypt SNMP messages using a FIPS 140-2 approved algorithm as shown in the example below. RP/0/0/CPU0:R3(config)#snmp-server group V3GROUP v3 auth read V3READ write V3WRITE RP/0/0/CPU0:R3(config)#snmp-server user V3USER V3GROUP v3 auth sha xxxxxx priv aes 256 xxxxxx RP/0/0/CPU0:R3(config)#snmp-server view V3READ iso included RP/0/0/CPU0:R3(config)#snmp-server view V3WRITE iso included RP/0/0/CPU0:R3(config)#snmp-server host x.x.x.x version 3 auth V3USER |