Details
This feature specifies a list of IP addresses that are allowed to use the community string to gain access to the SNMP agent.
Rationale:
If ACLs are not applied, then anyone with a valid SNMP community string can potentially monitor and manage the router. An ACL should be defined and applied for all SNMP access to limit access to a small number of authorized management stations segmented in a trusted management zone. If possible, use SNMPv3 which uses authentication, authorization, and data privatization (encryption).
Impact:
To reduce the risk of unauthorized access, Organizations should enable access control lists for all snmp-server communities and restrict the access to appropriate trusted management zones. If possible, implement SNMPv3 to apply authentication, authorization, and data privatization (encryption) for additional benefits to the organization.
Solution
Configure authorized SNMP community string and restrict access to authorized management systems.
hostname(config)#snmp-server community <community_string> ro {snmp_access-list_number |
snmp_access-list_name}
Default Value:
No ACL is set for SNMP
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system Cisco.