Fortinet FortiGate
TMA-FORTIGATE-2.3.2
Allow only trusted hosts in SNMPv3
Descripción
Ensuring that only certain hosts are able to conduct SNMP GET or receive SNMP Trap. FAILs if any SNMPv3 user lists 0.0.0.0 in notify-hosts. Audited against FortiOS 'show full-configuration' output (run it from the global context on VDOM-enabled units and save the full output); patterns are scoped to the named 'config ... end' block, whose member lines are indented.
Cómo se verifica
Método de auditoría: Patrón de configuración
- Patrón
(?m)^config system snmp user\n(?:[ \t]+[^\n]*\n)*?[ \t]+set notify-hosts [^\n]*\b0\.0\.0\.0\b[^\n]*[ \t]*$
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
config system snmp user edit "<user>" unselect notify-hosts 0.0.0.0 set notify-hosts <nms-ip> next end # CIS guidance: To remove 0.0.0.0 from trusted hosts in CLI: config system snmp user edit "snmp_test" unselect notify-hosts 0.0.0.0 end From GUI: 1. System > SNMP. 2. On SNMPv3 section, double click on the configured SNMPv3 settings. 3. Remove 0.0.0.0 from "Hosts" option.
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- fortigatesnmp
- Referencia
- CIS FortiGate 7.4.x Benchmark v1.0.1 - 2.3.2 Allow only trusted hosts in SNMPv3
Verificar este host
Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.
tmaegis scan --target fortigate --level 2