SNMP

The Service Assurance Manager (SAM) consists of two elements: managers and agents. The manager is the entity through which network management tasks are facilitated. An agent is a software module integrated into the operating system of the managed device that communicates with the network manager. Managed devices, such as bridges, hubs, routers, and network servers can contain managed objects. A managed object can be a configuration attribute, performance statistic, or control action that is directly related to the operation of a device.

Managed devices collect and store management information and use Simple Network Management Protocol (SNMP). SNMP is an application-layer protocol that provides a message format to facilitate communication between SNMP managers and agents. SNMP provides a standard framework to monitor and manage devices in a network from a central location.

An SNMP manager controls and monitors the activities of network hosts that use SNMP. An SNMP manager can obtain (get) a value from an SNMP agent or store (set) a value in the agent. The manager uses definitions in the management information base (MIB) to perform operations on the managed device such as retrieving values from variables or blocks of data, replying to requests, and processing traps.

Between the SNMP agent and the SNMP manager, the following actions can occur.

• The manager can get information from the agent.

• The manager can set the value of a MIB object that is controlled by an agent.

• The agent can send traps to notify the manager of significant events that occur on the managed device (for example, the 7705 SAR router).

SNMP is supported on network hosts using the IPv4 and IPv6 protocols.

A MIB is a formal specifications document with definitions of management information used to remotely monitor, configure, and control a managed device or network system. The agent’s management information consists of a set of network objects that can be managed with SNMP. Object identifiers are unique object names that are organized in a hierarchical tree structure. The main branches are defined by the Internet Engineering Task Force (IETF). When requested, the Internet Assigned Numbers Authority (IANA) assigns a unique branch for use by a private organization or company. The branch assigned to the 7705 SAR is 1.3.6.1.4.1.6527.

The SNMP agent provides management information to support a collection of IETF specified MIBs and a number of MIBs defined to manage device parameters and network data unique to the 7705 SAR.

The agent supports multiple versions of the SNMP protocol.

• SNMP Version 1 (SNMPv1) is the original Internet-standard network management framework.

  SNMPv1 provides access control for communities and uses a community string match for authentication.

• SNMPv2c uses a community string match for authentication.

• SNMP Version 3 (SNMPv3) provides access control for users. In SNMPv3, User-based Security Model (USM) defines the user authentication and encryption features. The View Access Control MIB (VACM) defines the user access control features. The SNMP-COMMUNITY-MIB is used to associate SNMPv1/SNMPv2c community strings with SNMPv3 VACM access control.

  SNMPv3 uses a username match for authentication.

By default, the 7705 SAR implementation of SNMP uses SNMPv3. SNMPv3 incorporates security model and security level features. A security model is the authentication type for the group and the security level is the permitted level of security within a security model. The combination of the security level and security model determines which security mechanism handles an SNMP packet.

To implement SNMPv1 and SNMPv2c configurations, several access groups are predefined. These access groups are standard read-only, read-write, and read-write-all access groups and views that can simply be assigned community strings. In order to implement SNMP with security features, security models, security levels, and USM communities must be explicitly configured. Optionally, additional views that specify more specific OIDs (MIB objects in the subtree) can be configured.

Access to the management information in an SNMPv1/SNMPv2c agent is controlled by the inclusion of a community name string in the SNMP request. The community defines the subset of the agent’s managed objects that can be accessed by the requester. It also defines what type of access is allowed: read-only or read-write.

The use of community strings provide minimal security and context checking for both agents and managers that receive requests and initiate trap operations. A community string is a text string that acts like a password to permit access to the agent on the 7705 SAR router.

The 7705 SAR implementation of SNMP has defined three levels of community-named access:

• read-only permission — grants only read access to objects in the MIB, except security objects

• read-write permission — grants read and write access to all objects in the MIB, except security objects

• read-write-all permission — grants read and write access to all objects in the MIB, including security objects

User-based security model (USM) community strings associate a community string with an SNMPv3 access group and its view. The access granted with a community string is restricted to the scope of the configured group.

Views control the access to a managed object. The total MIB of a 7705 SAR router can be viewed as a hierarchical tree. When a view is created, either the entire tree or a portion of the tree can be specified and made available to a user to manage the objects contained in the subtree. Object identifiers (OIDs) uniquely identify managed objects. A view defines the type of operations allowed, such as read, write, or notify.

OIDs are organized in a hierarchical tree with specific values assigned to different organizations. A view defines a subset of the agent’s managed objects controlled by the access rules associated with that view.

Predefined views are available that are particularly useful when configuring SNMPv1 and SNMPv2c.

The SNMP agent associates SNMPv1 and SNMPv2c community strings with an SNMPv3 view.

Access groups associate a user group and a security model with the views the group can access. An access group is defined by a unique combination of a group name, security model (SNMPv1, SNMPv2c, or SNMPv3), and security level (no-authorization-no-privacy, authorization-no-privacy, or privacy).

An access group is a template that defines a combination of access privileges and views. A group can be associated with one or more network users to control their access privileges and views.

Additional access parameters must be explicitly configured if the preconfigured access groups and views for SNMPv1 and SNMPv2c do not meet the security requirements.

By default, authentication and encryption parameters are not configured. Authentication parameters that a user must use in order to be validated by the 7705 SAR can be modified. SNMP authentication allows the device to validate the managing node that issued the SNMP message and determine if the message has been tampered with.

User access and authentication privileges must be explicitly configured. In a user configuration, a user is associated with an access group, which is a collection of users who have common access privileges and views.

The following SNMPv3 authentication protocols are supported:

• HMAC -MD5-96

• HMAC-SHA-96

• HMAC-SHA-224

• HMAC-SHA-256

• HMAC-SHA-384

• HMAC-SHA-512

The following SNMPv3 privacy protocols are supported:

• CBC-DES

• CFB128-AES-128

• CFB128-AES-192

• CFB128-AES-256

The 7705 SAR router is based on SNMPv3. To use 7705 SAR routers with SNMPv1 or SNMPv2c, SNMP community strings must be configured. Three predefined access methods are available when SNMPv1 or SNMPv2c access is required. Each access method (r, rw, or rwa) is associated with an SNMPv3 access group that determines the access privileges and the scope of managed objects available. The community command is used to associate a community string with a specific access method and the required SNMP version (SNMPv1 or SNMPv2c). The access methods are:

• read-only — grants read-only access to the entire management structure with the exception of the security area

• read-write — grants read and write access to the entire management structure with the exception of the security area

• read-write-all — grants read and write access to the entire management structure, including security

If the predefined access groups do not meet your access requirements, then additional access groups and views can be configured. The usm-community command is used to associate an access group with an SNMPv1 or SNMPv2c community string.

SNMP trap destinations are configured in the config>log>snmp-trap-group context.

The 7705 SAR implements SNMPv3. If security features other than the default views are required, the following parameters must be configured:

• views

• access groups

• SNMP users

SNMPv1 and SNMPv2c community strings are used to define the relationship between an SNMP manager and agent. The community string acts like a password to allow access to the agent. The access granted with a community string is restricted to the scope of the configured group.

One or more of the following characteristics associated with the string can be specified:

• read-only, read-write, and read-write-all permission for the MIB objects accessible to the community

• assignment of a unique community string to the management router or management VPLS

• the SNMP version: SNMPv1, SNMPv2c, or both

Default access features are preconfigured by the agent for SNMPv1 and SNMPv2c.

Use the following CLI syntax to configure community options:

CLI Syntax:

config>system>security>snmp
    community community-string [hash | hash2] access-permissions [version SNMP-version]

The following example displays community string command usage:

Example:

config>system>security# snmp 
config>system>security>snmp# community private hash2 rwa version both 
config>system>security>snmp# community public hash2 r version v2c

The following example displays the SNMP community configuration:

ALU-1>config>system>security>snmp# info
-------------------------------------------------------
     community "uTdc9j48PBRkxn5DcSjchk" hash2 rwa version both
     community "Lla.RtAyRW2" hash2 r version v2c
-------------------------------------------------------
ALU-1>config>system>security>snmp#

Use the following CLI syntax to configure view options:

CLI Syntax:

config>system>security>snmp
    view view-name subtree oid-value
        mask mask-value[type {included | excluded}]

The following example displays view command usage:

Example:

config>system>security>snmp# view testview subtree 1
config>system>security>snmp>view$ mask ff type included
config>system>security>snmp>view$ exit
config>system>security>snmp# view testview subtree 1.3.6.1.2
config>system>security>snmp>view$ mask ff type X
config>system>security>snmp>view$ exit

The following example displays the view configuration:

ALU-1>config>system>security>snmp# info
----------------------------------------------
                view "testview" subtree 1
                    mask ff
                exit
                view testview subtree 1.3.6.1.2
                    mask ff type excluded
                exit
                community "private" rwa version both
                community "public" r version v2c
----------------------------------------------
ALU-1>config>system>security>snmp#

The access command creates an association between a user group, a security model, and the views that the user group can access. Access must be configured unless security is limited to the preconfigured access groups and views for SNMPv1 and SNMPv2c. An access group is defined by a unique combination of the group name, security model, and security level.

Use the following CLI syntax to configure access features:

CLI Syntax:

config>system>security>snmp
    access group group-name security-model security-model security-level security-level [context context-name [prefix-match]] [read view-name-1] [write view-name-2] [notify view-name-3]

The following example displays access command usage:

Example:

ALU-1>config>system>security>snmp# access group
testgroup security-model usm security-level auth-no-privacy read testview write testview notify testview

The following example displays the access configuration with the view configurations.

ALU-1>config>system>security>snmp# info
----------------------------------------------
    view ‟testview” subtree 1
                    mask ff
                exit
                view ‟testview” subtree 1.3.6.1.2
                    mask ff type excluded
                exit
                access group ‟testgroup” security-model usm security-level auth-no
-privacy read ‟testview” write ‟testview” notify ‟testview”
                community "public" r version both
----------------------------------------------

Use the following CLI syntax to configure user group and authentication parameters:

CLI Syntax:

config>system>security# user user-name
    access [ftp] [snmp] [console]
    snmp
        authentication none
        authentication authentication-protocol authentication-key [privacy none] [hash | hash2]
        authentication authentication-protocol authentication-key privacy privacy-protocol privacy-key [hash|hash2]
        no authentication
    group group-name

The following example displays user security command usage:

Example:

config>system>security# user testuser
config>system>security>user$ access snmp
config>system>security>user# snmp
config>system>security>user>snmp# authentication hash hmac-md5-96 e14672e71d3e96e7a1e19472527ee969 privacy none
config>system>security>user>snmp# group testgroup
config>system>security>user>snmp# exit
config>system>security>user# exit

The following example displays the user’s SNMP configuration.

ALU-1>config>system>security# info
----------------------------------------------
    user "testuser"
        access snmp
        snmp
            authentication hash hmac-md5-96  e14672e71d3e96e7a1e19472527ee969 
privacy none
            group testgroup
        exit
    exit
...
----------------------------------------------
ALU-1>config>system>security#

User-based security model (USM) community strings associate a community string with an SNMPv3 access group and its view. The access granted with a community string is restricted to the scope of the configured group.

By default, the 7705 SAR implementation of SNMP uses SNMPv3. To implement SNMPv1 and SNMPv2c, USM community strings must be explicitly configured.

Use the following CLI syntax to configure USM community options:

CLI Syntax:

config>system>security>snmp
    usm-community community-string [hash | hash2] group group-name

The following example displays USM community string command usage. The group ‟testgroup” was configured in the config>system>security>snmp>access CLI context.

Example:

config>system>security>snmp# usm-community "test" hash2 group "testgroup"

The following example displays the SNMP community configuration:

ALU-1>config>system>security>snmp# info
----------------------------------------------
                view testview subtree 1
                    mask ff
                exit
                view testview subtree 1.3.6.1.2
                    mask ff type excluded
                exit
                access group testgroup security-model usm security-level auth-no
-privacy read testview write testview notify testview
                community "private" hash2 rwa version both
                community "public" hash r version v2c
                usm-community "test" group "testgroup"
----------------------------------------------
ALU-1>config>system>security>snmp#

Use the following CLI syntax to modify the system SNMP options:

CLI Syntax:

config>system>snmp
    engineID engine-id
    general-port port
    packet-size bytes
    no shutdown

The following example displays the system SNMP default values:

ALU-104>config>system>snmp# info detail
----------------------------------------------
            shutdown
            engineID "0000xxxx000000000xxxxx00"
            packet-size 1500
            general-port 161
----------------------------------------------
ALU-104>config>system>snmp#