The Palo Alto Networks security platform must not use SNMP Versions 1 or 2.
An XCCDF Rule
Description
<VulnDiscussion>SNMP Versions 1 and 2 are not considered secure. Without the strong authentication and privacy that is provided by the SNMP Version 3 User-based Security Model (USM), an unauthorized user can gain access to network management information used to launch an attack against the network. SNMP Versions 1 and 2 cannot authenticate the source of a message nor can they provide encryption. Without authentication, it is possible for nonauthorized users to exercise SNMP network management functions. It is also possible for nonauthorized users to eavesdrop on management information as it passes from managed systems to the management system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-228670r856016_rule
- Severity
- High
- References
- Updated
Remediation - Manual Procedure
Go to Device >> Setup >> Operations; in the Miscellaneous pane, select SNMP Setup.
In the SNMP Setup window, complete the required fields.
For the Version, select V3.
Configure a view and assign it to a user.
In the upper half of the SNMP Setup window, select "Add".
In the Views window, complete the required fields; obtain the values for the OID and Mask fields from product documentation or vendor support.