STIGQter: STIG Summary: Juniper SRX Services Gateway NDM Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 30 Jan 2025:

The Juniper SRX Services Gateway must use and securely configure SNMPv3 if SNMP is enabled.

DISA Rule

SV-223211r1056173_rule

Vulnerability Number

V-223211

Group Title

SRG-APP-000142-NDM-000245

Rule Version

JUSX-DM-000111

Severity

CAT I

CCI(s)

CCI-000382 - Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services.
CCI-001967 - Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.

Weight

Fix Recommendation

Enable and configure SNMPv3 and configure a trap and community string.

[edit]
set snmp location <LOCATION-NAME>
set snmp v3 usm local-engine user <USER-NAME> privacy-AES128 authentication-sha256
set snmp v3 vacm security-to-group security-model usm security-name <SECURITY-NAME> group <GROUP-NAME>
set snmp v3 vacm access group <GROUP-NAME> default-context-prefix security-model usm
security-level privacy read-view all
set snmp v3 vacm access group <GROUP-NAME> default-context-prefix security-model usm
security-level privacy notify-view all
set snmp v3 target-address <target-address-name> tag-list <SNMP-trap-receiver>
set snmp v3 target-address <TARGER-ADDRESS-NAME> target-parameters <PARMS-NAME>
set snmp v3 target-parameters <PARMS-NAME> parameters message-processing-model v3
set snmp v3 target-parameters <PARMS-NAME> parameters security-model usm
set snmp v3 target-parameters <PARMS-NAME> parameters security-level privacy
set snmp v3 target-parameters <PARMS-NAME> parameters security-name <SECURITY-NAME>
set snmp v3 target-parameters <PARMS-NAME> notify-filter device-traps
set snmp v3 notify <SNMP-TRAPS> type trap
set snmp v3 notify <SNMP-TRAPS> tag <SNMP-TRAP-RECEIVER>
set snmp v3 notify-filter device-traps oid jnxChassisTraps include
set snmp v3 notify-filter device-traps oid jnxChassisOKTraps include
set snmp v3 notify-filter device-traps oid system include
set snmp v3 notify-filter device-traps oid .1 include
set snmp v3 notify-filter device-traps oid snmpMIBObjects include
set snmp engine-id use-mac-address
set snmp view all oid .1 include
set snmp view all oid system include
set snmp view all oid jnxBoxAnatomy include
set snmp view all oid snmpMIBObjects include

Check Contents

If an SNMP stanza does not exist, this is not a finding.

Verify SNMPv3 is enabled and configured.

[edit]
show snmp

If versions earlier than SNMPv3 are enabled, this is a finding.

Vulnerability Number

V-223211

Documentable

False

Rule Version

JUSX-DM-000111

Severity Override Guidance

If an SNMP stanza does not exist, this is not a finding.

Verify SNMPv3 is enabled and configured.

[edit]
show snmp

If versions earlier than SNMPv3 are enabled, this is a finding.

Check Content Reference

Target Key

4098