Free DISA STIG and SRG Library | Vaulted

V-3021

Network devices must only allow SNMP access from addresses belonging to the management network.

Finding ID
NET0890
Rule ID
SV-3021r3_rule
Severity
Cat II
CCE
(None)
Group Title
SNMP access is not restricted by IP address.
CCI
(None)
Target Key
(None)
Documentable
No
Discussion

Detailed information about the network is sent across the network via SNMP. If this information is discovered by attackers it could be used to trace the network, show the networks topology, and possibly gain access to network devices.

Fix Text

Configure the network devices to only allow SNMP access from only addresses belonging to the management network.

Check Content

Review the device configuration and verify it is configured to only allow SNMP access from addresses belonging to the management network. If the device is not configured to filter SNMP from the management network only, this is a finding.

Responsibility

Information Assurance Officer