OpenControls Logo

STIG Viewer

STIGViewer Support

The Palo Alto Networks security platform must not use SNMP Versions 1 or 2.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-228670PANW-NM-000118SV-228670r961557_ruleCCI-003123high
Description
SNMP Versions 1 and 2 are not considered secure. Without the strong authentication and privacy that is provided by the SNMP Version 3 User-based Security Model (USM), an unauthorized user can gain access to network management information used to launch an attack against the network. SNMP Versions 1 and 2 cannot authenticate the source of a message nor can they provide encryption. Without authentication, it is possible for nonauthorized users to exercise SNMP network management functions. It is also possible for nonauthorized users to eavesdrop on management information as it passes from managed systems to the management system.
STIGDate
Palo Alto Networks NDM Security Technical Implementation Guide2025-03-12

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

MNT-05.3Remote Maintenance Cryptographic Protection
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (26) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-2(4)Automated Audit Actions
1.00
AC-4Information Flow Enforcement
1.00
AC-6(9)Log Use of Privileged Functions
1.00
AU-12Audit Record Generation
1.00
AU-3Content of Audit Records
1.00
AU-9(3)Cryptographic Protection
1.00
CM-5(1)Automated Access Enforcement and Audit Records
1.00
CM-6Configuration Settings
1.00

+16 more (top 10 by confidence shown)

CCI1 mapping
CCI-003123
1.00

Details

Check Text (C-228670r961557_chk)

Go to Device >> Setup >> Operations; in the Miscellaneous pane, select SNMP Setup. In the SNMP Setup window, check if SNMP V3 is selected. If V3 is not selected, this is a finding. Go to Device >> Server Profiles >> SNMP Trap. View the list of configured SNMP servers; if the Version is not "v3", this is a finding.

Fix Text (F-30882r513614_fix)

Go to Device >> Setup >> Operations; in the Miscellaneous pane, select SNMP Setup. In the SNMP Setup window, complete the required fields. For the Version, select V3. Configure a view and assign it to a user. In the upper half of the SNMP Setup window, select "Add". In the Views window, complete the required fields; obtain the values for the OID and Mask fields from product documentation or vendor support. In the Option field, select "include". Select "OK". In the lower half of the SNMP Setup window, select "Add". Complete the required fields. Select "OK". Obtain the engineID of the Palo Alto device by issuing an SNMPv3 GET from the management workstation against the OID of the Palo Alto device. Configure the SNMPv3 Trap Server profile; go to Device >> Server Profiles >> SNMP Trap; select "Add". In the SNMP Trap Server Profile window, complete the required fields. Select "OK". Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.