Detections
Analytics

2.7.3 Use SNMPv3 Instead of Earlier Versions

Information

The network element should use SNMP Version 3 for any SNMP agent configured on the device.

SNMPv2 only requires a community string to be specified, which the client needs to use in their requests to "authenticate".

SNMPv3 uses an actual security model called "User-based Security Model" (USM) codified in RFC3414 (originally in RFC2264 1998). USM supports authentication and encryption.

Solution

snmp-server group group1 v3 priv
snmp-server user user1 group1 v3 auth sha256 12345 priv aes256 {password}
snmp-server host server1 version 3 priv user1

Impact:

Client requests will also need to use snmpv3 to poll the device.

See Also

https://workbench.cisecurity.org/benchmarks/25683

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-13

Plugin: Arista

Control ID: 781984a4fe817e441f11591383b80a07b1a03da90dd9353694be74a17d35d2b0