5.4 Ensure 'Default Restrict' is set in all client lists

Information

Limit clients to access SNMP.

Rationale:

Even when limited to read only access, SNMP can provide an attacker with a wealth of information about your router and network topology.

To limit the potential for attacks against your routers SNMP service your client lists should be configured to deny any source address which is not explicitly permitted (by being added to the list).

Solution

To configure a client list issue the following command under the [edit snmp client-list <client list name>] hierarchy;

[edit snmp client-list <client list name>]
user@host#set default restrict

Note - Client-lists may also be defined directly under the [edit snmp community <community name> clients] hierarchy for use within the specified community with the same effect, but for ease of management and audit, the first method is preferred.

Default Value:

No SNMP communities are set by default on most platforms.

See Also

https://workbench.cisecurity.org/files/3069

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-3, CSCv7|4.6

Plugin: Juniper

Control ID: e3329b30b3b1ca5795839b3d87404c2d4a71d659b147427128cefe1dac2e8f51