STIGQter: STIG Summary: Juniper EX Series Switches Network Device Management Security Technical Implementation Guide Version: 2 Release: 5 Benchmark Date: 01 Jul 2026:

The Juniper EX switch must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).

DISA Rule

SV-253925r961506_rule

Vulnerability Number

V-253925

Group Title

SRG-APP-000395-NDM-000310

Rule Version

JUEX-NM-000480

Severity

CAT I

CCI(s)

• CCI-001967 - Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.

Weight

10

Fix Recommendation

Configure the network device to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).

set snmp v3 usm local-engine user <SNMPv3 username> authentication-sha authentication-password "PSK"

Check Contents

Review the network device configuration to verify SNMP messages are authenticated using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).

By default, SNMP is disabled. If used, verify SNMPv3 is configured (minimally) for authentication-sha. Although HMAC-MD5-96 is supported as required by RFC, Junos also supports HMAC-SHA, HMAC-SHA224/256/384/512. Configure the strongest HMAC supported by both the Juniper device and the Network Management System (NMS).

[edit snmp v3]
usm {
local-engine {
user <SNMPv3 user> {
authentication-sha {
authentication-key "$8$aes256-gcm$hmac-sha2-256$100$2CM/LosUGF4$A...<snip>...rflBKxq/w+jaAVF55Bsc6PA"; ## SECRET-DATA
}
}
}
}

If the network device is not configured to authenticate SNMP messages using a FIPS-validated HMAC, this is a finding.

Vulnerability Number

V-253925

Documentable

False

Rule Version

JUEX-NM-000480

Severity Override Guidance

Review the network device configuration to verify SNMP messages are authenticated using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).

By default, SNMP is disabled. If used, verify SNMPv3 is configured (minimally) for authentication-sha. Although HMAC-MD5-96 is supported as required by RFC, Junos also supports HMAC-SHA, HMAC-SHA224/256/384/512. Configure the strongest HMAC supported by both the Juniper device and the Network Management System (NMS).

[edit snmp v3]
usm {
local-engine {
user <SNMPv3 user> {
authentication-sha {
authentication-key "$8$aes256-gcm$hmac-sha2-256$100$2CM/LosUGF4$A...<snip>...rflBKxq/w+jaAVF55Bsc6PA"; ## SECRET-DATA
}
}
}
}

If the network device is not configured to authenticate SNMP messages using a FIPS-validated HMAC, this is a finding.

Check Content Reference

M

Target Key

5477