Details
SNMP should only be configured on Out of Band management interfaces.
Rationale:
By default the SNMP service will listen for incoming connections on all interfaces which have an IP Address configured, exposing SNMP to users on all networks through which the router is reachable.
In higher security environments management services, such as SNMPv3, should be restricted such as to only be reachable through the Out of Band management port which is available on most JUNOS platforms.
The name of the Out of Band Management port varies considerably between platforms, typically:
fxp[0-9] on most routing platforms and SRX firewalls
me[0-9] on most EX and some QFX switches
em[0-9] on some EX and QFX switches
jmgmt0 on NFX platforms
NOTE: SNMP does not appear to be configured on the target. This check is not applicable.
Solution
To restrict SNMP to required interfaces issue the following command from the [edit snmp] hierarchy;
[edit snmp]
[email protected]#set interface
To delete an existing interface from the list issue the following command from the [edit snmp] hierachy;
[edit snmp]
[email protected]#delete interface
Default Value:
By default SNMP, when configured, is accessible over all configured interfaces.
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system Juniper.