InformationLimit clients to access SNMP.
Even when limited to read only access, SNMP can provide an attacker with a wealth of information about your router and network topology.
To limit the potential for attacks against your routers SNMP service your client lists should be configured to deny any source address which is not explicitly permitted (by being added to the list).
NOTE: SNMP does not appear to be configured on the target. This check is not applicable.
SolutionTo configure a client list issue the following command under the [edit snmp client-list <client list name>] hierarchy;
[edit snmp client-list <client list name>]
[email protected]#set default restrict
Note - Client-lists may also be defined directly under the [edit snmp community <community name> clients] hierarchy for use within the specified community with the same effect, but for ease of management and audit, the first method is preferred.
No SNMP communities are set by default on most platforms.