STIGQter: STIG Summary: Palo Alto Networks NDM Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 24 Jan 2020:

The Palo Alto Networks security platform must not use SNMP Versions 1 or 2.

DISA Rule

SV-77257r1_rule

Vulnerability Number

V-62767

Group Title

SRG-APP-000412-NDM-000331

Rule Version

PANW-NM-000118

Severity

CAT I

CCI(s)

• CCI-003123 - The information system implements cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.

Weight

10

Fix Recommendation

Go to Device >> Setup >> Operations; in the Miscellaneous pane, select SNMP Setup.
In the SNMP Setup window, complete the required fields.
For the Version, select V3.
Configure a view and assign it to a user.
In the upper half of the SNMP Setup window, select "Add".
In the Views window, complete the required fields; obtain the values for the OID and Mask fields from product documentation or vendor support.
In the Option field, select "include".
Select "OK".
In the lower half of the SNMP Setup window, select "Add".
Complete the required fields.
Select "OK".
Obtain the engineID of the Palo Alto device by issuing an SNMPv3 GET from the management workstation against the OID of the Palo Alto device.
Configure the SNMPv3 Trap Server profile; go to Device >> Server Profiles >> SNMP Trap; select "Add".
In the SNMP Trap Server Profile window, complete the required fields.
Select "OK".
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.

Check Contents

Go to Device >> Setup >> Operations; in the Miscellaneous pane, select SNMP Setup.
In the SNMP Setup window, check if SNMP V3 is selected.
If V3 is not selected, this is a finding.

Go to Device >> Server Profiles >> SNMP Trap.
View the list of configured SNMP servers; if the Version is not "v3", this is a finding.

Vulnerability Number

V-62767

Documentable

False

Rule Version

PANW-NM-000118

Severity Override Guidance

Go to Device >> Setup >> Operations; in the Miscellaneous pane, select SNMP Setup.
In the SNMP Setup window, check if SNMP V3 is selected.
If V3 is not selected, this is a finding.

Go to Device >> Server Profiles >> SNMP Trap.
View the list of configured SNMP servers; if the Version is not "v3", this is a finding.

Check Content Reference

M

Target Key

2811

Comments