Detections
Analytics

2.7.2 Ensure SNMP Community

Information

Only allow SNMP read access and ensure that the default or well-known SNMP community strings public and private are not used. An ACL should be used to further restrict which remote hosts can query the switch.

Enabling write access to the device via SNMP provides a mechanism that can be exploited by an attacker to set configuration variables that can disrupt network operations.

Solution

no snmp-server community public
no snmp-server community private
snmp-server community {community string} ro {snmp security acl}

Impact:

Changing SNMP communities requires matching configuration on remote devices that access the device via snmp.

See Also

https://workbench.cisecurity.org/benchmarks/25683

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-2

Plugin: Arista

Control ID: 901a3421e9d70c539927864e5c81075d22a2964d41652e0b92fa1f2e8b48690c