The network element must only allow write and poll SNMP access by authorized internal IP addresses.

From Infrastructure Router Security Technical Implementation Guide Juniper

Part of SNMP access is not restricted by IP address.

SV-15333r2_rule The network element must only allow write and poll SNMP access by authorized internal IP addresses.

Vulnerability discussion

Detailed information about the network is sent across the network via SNMP. If this information is discovered by attackers it could be used to trace the network, show the networks topology, and possibly gain access to network devices.

Check content

Review device configuration and verify that it is configured to only allow SNMP access from only addresses belonging to the management network as shown in the following example: snmp { interface ge-0/1/0.0; community xxxxxxxxx { authorization read-only; clients { default restrict; 7.7.7.5/32; } } } Note: if the clients statement is not present, then all clients are allowed.

Fix text

Configure the network devices to only allow SNMP access from only addresses belonging to the management network.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.