For nonlocal maintenance sessions using SNMP, the Juniper SRX Services Gateway must use and securely configure SNMPv3 with SHA256 or higher to protect the integrity of maintenance and diagnostic communications.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
high	V-223224	SRG-APP-000411-NDM-000330	JUSX-DM-000146	SV-223224r1056178_rule	2024-12-20	3

Description
Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Nonlocal maintenance and diagnostic activities are activities conducted by individuals communicating through an external network (e.g., the internet) or internal network. The Juniper SRX allows the use of SNMP to monitor or query the device in support of diagnostic information. SNMP cannot be used to make configuration changes; however, it is a valuable diagnostic tool. SNMP is disabled by default and must be enabled for use. SNMPv3 is the DOD-required version but must be configured to be used securely.

Description

Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Nonlocal maintenance and diagnostic activities are activities conducted by individuals communicating through an external network (e.g., the internet) or internal network. The Juniper SRX allows the use of SNMP to monitor or query the device in support of diagnostic information. SNMP cannot be used to make configuration changes; however, it is a valuable diagnostic tool. SNMP is disabled by default and must be enabled for use. SNMPv3 is the DOD-required version but must be configured to be used securely.

ℹ️ Check
Verify SNMP is configured for version 3. [edit] show snmp v3 If SNMPv3 is not configured for version 3 using SHA256 or higher, this is a finding.

✔️ Fix
Configure snmp to use version 3 with SHA256 authentication. [edit] set snmp v3 usm local-engine user <NAME> authentication-sha256