UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The network element must only allow write and poll SNMP access by authorized internal IP addresses.


Overview

Finding ID Version Rule ID IA Controls Severity
V-3021 NET0890 SV-15333r2_rule Medium
Description
Detailed information about the network is sent across the network via SNMP. If this information is discovered by attackers it could be used to trace the network, show the networks topology, and possibly gain access to network devices.
STIG Date
Perimeter Router Security Technical Implementation Guide Juniper 2016-07-07

Details

Check Text ( C-12799r3_chk )
Review device configuration and verify that it is configured to only allow SNMP access from only addresses belonging to the management network as shown in the following example:

snmp {
interface ge-0/1/0.0;
community xxxxxxxxx {
authorization read-only;
clients {
default restrict;
7.7.7.5/32;
}
}
}

Note: if the clients statement is not present, then all clients are allowed.
Fix Text (F-3046r4_fix)
Configure the network devices to only allow SNMP access from only addresses belonging to the management network.