← Back to HPE Aruba Networking AOS NDM Security Technical Implementation Guide

V-266952

CAT II (Medium)

AOS must generate an immediate real-time alert of all audit failure events requiring real-time alerts.

Rule ID

SV-266952r1039877_rule

STIG

HPE Aruba Networking AOS NDM Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-001858

Discussion

It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impending failure of the audit capability, and system operation may be adversely affected.

Check Content

Verify the AOS configuration with the following commands: 
show snmp trap-hosts 
show snmp trap-list | include wlsxProcessDied 
show snmp trap-list | include wlsxProcessRestart 
 
If a SNMP server is not configured and both process traps are not enabled, this is a finding.

Fix Text

Configure AOS with the following commands: 
configure terminal 
snmp-server host <IPv4 or IPv6 address> version <SNMP version> snmp-server host <IPv4 or IPv6 address> version <SNMP version> <SNMPv3 username> engine-id <SNMP engine ID> 
snmp-server trap wlsxProcessDied 
snmp-server trap wlsxProcessRestart 
write memory