STIGQter: STIG Summary: Juniper SRX Services Gateway NDM Security Technical Implementation Guide Version: 3 Release: 3 Benchmark Date: 30 Jan 2025:

The Juniper SRX Services Gateway must securely configure SNMPv3 with privacy options to protect the confidentiality of nonlocal maintenance and diagnostic communications using SNMP.

DISA Rule

SV-223226r1056109_rule

Vulnerability Number

V-223226

Group Title

SRG-APP-000412-NDM-000331

Rule Version

JUSX-DM-000149

Severity

CAT I

CCI(s)

CCI-003123 - Implement organization-defined cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.

Weight

Fix Recommendation

Configure SNMP to use version 3 with privacy options. The following is an example.

[edit]
set snmp location <NAME>
set snmp v3 usm local-engine user <NAME> privacy-AES128
set snmp v3 vacm security-to-group security-model usm security-name <NAME> group <NAMEGROUP>
set snmp v3 vacm access group <NAME-GROUP> default-context-prefix security-model usm
security-level privacy read-view all
set snmp v3 vacm access group <NAME-GROUP> default-context-prefix security-model usm
security-level privacy notify-view all

Check Contents

Verify SNMPv3 is configured with privacy options.

[edit]
show snmp v3

If SNMPv3 is not configured using AES, and other privacy options are not configured, this is a finding.

Vulnerability Number

V-223226

Documentable

False

Rule Version

JUSX-DM-000149

Severity Override Guidance

Verify SNMPv3 is configured with privacy options.

[edit]
show snmp v3

If SNMPv3 is not configured using AES, and other privacy options are not configured, this is a finding.

Check Content Reference

Target Key

4098