Details
Limit clients to access SNMP.
Rationale:
Even when limited to read only access, SNMP can provide an attacker with a wealth of information about your router and network topology.
To limit the potential for attacks against your routers SNMP service you should limit the IP addresses that are permitted to connect using a client-list. This ensure that individual community strings are used to authenticate only by the systems in the list, providing granular access control that should be applied in addition to any firewall filter.
Solution
To configure a client list issue the following command under the [edit snmp] hierarchy;
[edit snmp]
[email protected]#edit client-list
[edit snmp client-list
[email protected]#set default restrict
[email protected]#set
[email protected]#set
[email protected]#up 1
[edit snmp]
[email protected]#edit community
[edit snmp community
[email protected]#set client-list-name
The set default restrict is covered in detail in the next recommendation.
Additional IP Addresses may be permitted by repeating the set
Optionally, addresses that you wish to deny from within a permitted range previously set can be configured with the set
Note – Client-lists may also be defined directly under the [edit snmp community
Default Value:
No SNMP communities are set by default on most platforms.
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system Juniper.