Allow only trusted hosts in SNMPv3

HighLevel 2Automatedfortigate

Description

Ensuring that only certain hosts are able to conduct SNMP GET or receive SNMP Trap. FAILs if any SNMPv3 user lists 0.0.0.0 in notify-hosts. Audited against FortiOS 'show full-configuration' output (run it from the global context on VDOM-enabled units and save the full output); patterns are scoped to the named 'config ... end' block, whose member lines are indented.

How it is checked

Audit method: Configuration pattern

Pattern: (?m)^config system snmp user\n(?:[ \t]+[^\n]*\n)*?[ \t]+set notify-hosts [^\n]*\b0\.0\.0\.0\b[^\n]*[ \t]*$

How it is fixed

Fix method: Guidance or infrastructure patch

config system snmp user edit "<user>" unselect notify-hosts 0.0.0.0 set notify-hosts <nms-ip> next end # CIS guidance: To remove 0.0.0.0 from trusted hosts in CLI: config system snmp user edit "snmp_test" unselect notify-hosts 0.0.0.0 end From GUI: 1. System > SNMP. 2. On SNMPv3 section, double click on the configured SNMPv3 settings. 3. Remove 0.0.0.0 from "Hosts" option.

Properties

Operating systems: Any
Tags: fortigatesnmp
Reference: CIS FortiGate 7.4.x Benchmark v1.0.1 - 2.3.2 Allow only trusted hosts in SNMPv3

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target fortigate --level 2