TMA-CISCO-IOSXR-1.5.4

Set the ACL for each 'snmp-server community'

AltaNivel 1Automatizadacisco-iosxr

Descripción

This feature specifies a list of IP addresses that are allowed to use the community string to gain access to the SNMP agent. If ACLs are not applied, then anyone with a valid SNMP community string can potentially monitor and manage the router. An ACL should be defined and applied for all SNMP access to limit access to a small number of authorized management stations segmented in a ... CIS marks this Manual; automated: fails if a community line carries no IPv4/IPv6 ACL. Audited against the hierarchical output of 'show running-config' (run 'terminal length 0' first; not 'show running-config formal').

Cómo se verifica

Método de auditoría: Patrón de configuración

Patrón: (?m)(?i)^snmp-server community \S+(?: (?:RO|RW))?(?: (?:SystemOwner|SDROwner))?[ \t\r]*$

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

! Configure authorized SNMP community string and restrict access to authorized management systems. snmp-server community {community_string} RO IPv4 {snmp_access-list}

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: cisco-iosxrnetworksnmp
Referencia: CIS Cisco IOS XR 7.x Benchmark v1.0.1 - 1.5.4 Set the ACL for each 'snmp-server community'

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target cisco-iosxr