STIGQter: STIG Summary: Juniper SRX SG NDM Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

If SNMP is enabled, the Juniper SRX Services Gateway must use and securely configure SNMPv3.

DISA Rule

SV-223211r513322_rule

Vulnerability Number

V-223211

Group Title

SRG-APP-000142-NDM-000245

Rule Version

JUSX-DM-000111

Severity

CAT I

CCI(s)

• CCI-000382 - The organization configures the information system to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services.

Weight

10

Fix Recommendation

Enable and configure SNMPv3 and configure a trap and community string.

[edit]
set snmp location <LOCATION-NAME>
set snmp v3 usm local-engine user <USER-NAME> privacy-AES128
set snmp v3 vacm security-to-group security-model usm security-name <SECURITY-NAME> group <GROUP-NAME>
set snmp v3 vacm access group <GROUP-NAME> default-context-prefix security-model usm
security-level privacy read-view all
set snmp v3 vacm access group <GROUP-NAME> default-context-prefix security-model usm
security-level privacy notify-view all
set snmp v3 target-address <target-address-name> tag-list <SNMP-trap-receiver>
set snmp v3 target-address <TARGER-ADDRESS-NAME> target-parameters <PARMS-NAME>
set snmp v3 target-parameters <PARMS-NAME> parameters message-processing-model v3
set snmp v3 target-parameters <PARMS-NAME> parameters security-model usm
set snmp v3 target-parameters <PARMS-NAME> parameters security-level privacy
set snmp v3 target-parameters <PARMS-NAME> parameters security-name <SECURITY-NAME>
set snmp v3 target-parameters <PARMS-NAME> notify-filter device-traps
set snmp v3 notify <SNMP-TRAPS> type trap
set snmp v3 notify <SNMP-TRAPS> tag <SNMP-TRAP-RECEIVER>
set snmp v3 notify-filter device-traps oid jnxChassisTraps include
set snmp v3 notify-filter device-traps oid jnxChassisOKTraps include
set snmp v3 notify-filter device-traps oid system include
set snmp v3 notify-filter device-traps oid .1 include
set snmp v3 notify-filter device-traps oid snmpMIBObjects include
set snmp engine-id use-mac-address
set snmp view all oid .1 include
set snmp view all oid system include
set snmp view all oid jnxBoxAnatomy include
set snmp view all oid snmpMIBObjects include

Check Contents

Verify SNMPv3 is enabled and configured.

[edit]
show snmp

If an SNMP stanza does not exist, this is not a finding.

If SNMPv3 is not configured to meet DoD requirements, this is a finding.

If versions earlier than SNMPv3 are enabled, this is a finding.

Vulnerability Number

V-223211

Documentable

False

Rule Version

JUSX-DM-000111

Severity Override Guidance

Verify SNMPv3 is enabled and configured.

[edit]
show snmp

If an SNMP stanza does not exist, this is not a finding.

If SNMPv3 is not configured to meet DoD requirements, this is a finding.

If versions earlier than SNMPv3 are enabled, this is a finding.

Check Content Reference

M

Target Key

4098

Comments