V-217338

Discussion

Without the strong encryption that is provided by the SNMP Version 3 User-based Security Model (USM), an unauthorized user can gain access to network management information that can be used to create a network outage.

Check Content

Review the router configuration to verify that it is compliant with this requirement as shown in the example below.

snmp {
    v3 {
        usm {
            local-engine {
                user R5_NMS {
                    authentication-sha {
                        authentication-key "$8$vOiLX-Vb2oaUwsJDiHmPz3690BcSevM"; ## SECRET-DATA
                    }
                    privacy-aes128 {
                        privacy-key "$8$3Q4T9CuOBESyK1IrvW87NwYgoDiPfz3nCs24Z"; ## SECRET-DATA
                    }
                }
            }
        }
        target-address NMS_HOST {
            address 10.1.58.2;
            address-mask 255.255.255.0;
            tag-list NMS;
            target-parameters TP1;
        }
        target-parameters TP1 {
            parameters {
                message-processing-model v3;
                security-model usm;
                security-level privacy;
                security-name R5_NMS;
            }
        }
        notify SEND_TRAPS {
            type trap;
            tag NMS;
        }
        snmp-community index1 {
            security-name R5_NMS;
            tag NMS;
        }
    }
} 

Note: SNMPv3 security level privacy also authenticates the messages using the configured HMAC.

If the router is not configured to encrypt SNMP messages using a FIPS 140-2 approved algorithm, this is a finding.