The network element must only allow SNMP access from addresses belonging to the management network.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-3021	NET0890	SV-41507r1_rule		Medium

Description
Detailed information about the network is sent across the network via SNMP. If this information is discovered by attackers it could be used to trace the network, show the networks topology, and possibly gain access to network devices.

STIG	Date
Firewall Security Technical Implementation Guide - Cisco	2016-12-21

Details

Check Text ( C-39986r2_chk )
Review device configuration and verify that it is configured to only allow SNMP access from only addresses belonging to the management network. The ASA appliance can send SNMP traps and can be polled via SNMP—it does not allow SNMP write access. The snmp-server host [trap\|poll] [community ] command is used to define a host that is allowed to poll the ASA and to receive traps from it. If one of the keywords trap or poll is specified, the host is limited to that function only. Otherwise, it can both receive traps from and poll the ASA device. The following example will send traps from its management interface to the host 10.1.0.100. This is the only host that will be able to poll the ASA appliance. snmp-server community xxxxxxxxxxxx snmp-server host mgmt 10.1.0.100 trap

Check Text ( C-39986r2_chk )

Review device configuration and verify that it is configured to only allow SNMP access from only addresses belonging to the management network. The ASA appliance can send SNMP traps and can be polled via SNMP—it does not allow SNMP write access. The snmp-server host [trap|poll] [community ] command is used to define a host that is allowed to poll the ASA and to receive traps from it.

If one of the keywords trap or poll is specified, the host is limited to that function only. Otherwise, it can both receive traps from and poll the ASA device.

The following example will send traps from its management interface to the host 10.1.0.100. This is the only host that will be able to poll the ASA appliance.

snmp-server community xxxxxxxxxxxx
snmp-server host mgmt 10.1.0.100 trap

Fix Text (F-3046r4_fix)
Configure the network devices to only allow SNMP access from only addresses belonging to the management network.