5.9 Ensure SNMP is set to OOB management only

Information

SNMP should only be configured on Out of Band management interfaces.

Rationale:

By default the SNMP service will listen for incoming connections on all interfaces which have an IP Address configured, exposing SNMP to users on all networks through which the router is reachable.

In higher security environments management services, such as SNMPv3, should be restricted such as to only be reachable through the Out of Band management port which is available on most JUNOS platforms.

The name of the Out of Band Management port varies considerably between platforms, typically:

fxp[0-9] on most routing platforms and SRX firewalls

me[0-9] on most EX and some QFX switches

em[0-9] on some EX and QFX switches

jmgmt0 on NFX platforms

Solution

To restrict SNMP to required interfaces issue the following command from the [edit snmp] hierarchy;

[edit snmp]
user@host#set interface <interface or interface list>

To delete an existing interface from the list issue the following command from the [edit snmp] hierachy;

[edit snmp]
user@host#delete interface <interface>

Default Value:

By default SNMP, when configured, is accessible over all configured interfaces.

See Also

https://workbench.cisecurity.org/files/3069

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7(15), CSCv7|11.7

Plugin: Juniper

Control ID: a72b2ae5cac1cb960636fc71bd53b49dee1a4bd574994f364ec6ec9ca9d547bc