OpenControls Logo

STIG Viewer

STIGViewer Support

The Juniper SRX Services Gateway must securely configure SNMPv3 with privacy options to protect the confidentiality of nonlocal maintenance and diagnostic communications using SNMP.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-223226JUSX-DM-000149SV-223226r1056109_ruleCCI-003123high
Description
Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session. Nonlocal maintenance and diagnostic activities are activities conducted by individuals communicating through an external network (e.g., the internet) or internal network. To protect the confidentiality of nonlocal maintenance sessions, SNMPv3 with AES encryption must be configured to provide confidentiality. The Juniper SRX allows the use of SNMPv3 to monitor or query the device in support of diagnostics information. SNMP cannot be used to make configuration changes; however, it is a valuable diagnostic tool. SNMP is disabled by default and must be enabled for use. SNMPv3 is the DOD-required version but must be configured to be used securely.
STIGDate
Juniper SRX Services Gateway NDM Security Technical Implementation Guide2024-12-20

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MNT-05.3Remote Maintenance Cryptographic Protection
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (26) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-2(4)Automated Audit Actions
1.00
AC-4Information Flow Enforcement
1.00
AC-6(9)Log Use of Privileged Functions
1.00
AU-12Audit Record Generation
1.00
AU-3Content of Audit Records
1.00
AU-9(3)Cryptographic Protection
1.00
CM-5(1)Automated Access Enforcement and Audit Records
1.00
CM-6Configuration Settings
1.00

+16 more (top 10 by confidence shown)

CCI1 mapping
CCI-003123
1.00

Details

Check Text (C-223226r1056109_chk)

Verify SNMPv3 is configured with privacy options. [edit] show snmp v3 If SNMPv3 is not configured using AES, and other privacy options are not configured, this is a finding.

Fix Text (F-24887r513366_fix)

Configure SNMP to use version 3 with privacy options. The following is an example. [edit] set snmp location <NAME> set snmp v3 usm local-engine user <NAME> privacy-AES128 set snmp v3 vacm security-to-group security-model usm security-name <NAME> group <NAMEGROUP> set snmp v3 vacm access group <NAME-GROUP> default-context-prefix security-model usm security-level privacy read-view all set snmp v3 vacm access group <NAME-GROUP> default-context-prefix security-model usm security-level privacy notify-view all