SNMP

SNMPv2c access group configuration

In SNMPv2c, the community value is mandatory and cannot contain spaces.

Optionally, the prefix-list value defines which managers can use the community (both IPv4 and IPv6 addresses) and is only supported in SNMPv2c.

The community-entry value cannot be the same as the community value because this reveals the plaintext value of the community.

In the following example, the SNMPv2c agent uses an access group for get requests. The minimum security level is configured.

--{ * candidate shared default }--[  ]--
# info system snmp
    system {
        snmp {
            access-group ag1 {
                admin-state enable
                security-level no-auth-no-priv
                community-entry ce1 {
                    community $aes1$AW/5wLmAOcTPhG8=$aFJfMhdHwSGTplCfsDgBPA==
                    prefix-list [
                        10.1.1.1/32
                    ]
                }
            }
            network-instance default {
                admin-state enable
            }
        }
    }

SNMPv2c trap group configuration

In the following example, the SNMPv2c agent uses a trap group within the default network instance. The minimum security level is configured. The SNMPv2c community value is configured using the community-entry parameter.

--{ * candidate shared default }--[  ]--
# info system snmp
    system {
        snmp {
            trap-group tg1 {
                admin-state enable
                network-instance default
                destination destination1 {
                    admin-state enable
                    address 10.2.2.2
                    security-level no-auth-no-priv
                    community-entry ce1 {
                        community $aes1$AWOTWOQo41n22m8=$XD4pX1F7pWJFtTdgwjf23w==
                    }
                }
            }
            network-instance default {
                admin-state enable
            }
        }
    }

SNMPv3 access group configuration

In the following example, the SNMPv3 agent uses an access group for get requests. The SNMPv3 user authentication and privacy protocols are configured using the security-entry parameter. The value of password cannot contain spaces.

--{ * candidate shared default }--[  ]--
# info system snmp
    system {
        snmp {
            access-group ag1 {
                admin-state enable
                security-level auth-priv
                security-entry se1 {
                    user user1 {
                    authentication {
                        protocol hmac-md5-96
                        password $aes1$AW8qEdNV+4KmIm8=$F2zgIDAO4DkcFh+6oLyd2w==
                    }
                    privacy {
                        protocol cbc-des
                        password $aes1$AW+ZudVoGPQP5W8=$1UMEKehkoPqo8zGFE0KzxA==
                    }
                }
            }
            network-instance default {
                admin-state enable
            }
        }
    }

SNMPv3 trap group configuration

In the following example, the SNMPv3 agent uses a trap group within the default network instance. The SNMPv3 user authentication and privacy protocols are configured using the security-entry parameter. The value of password cannot contain spaces.

--{ * candidate shared default }--[  ]--
# info system snmp
    system {
        snmp {
            trap-group tg1 {
                admin-state enable
                network-instance default
                destination destination1 {
                    admin-state enable
                    address 10.2.2.2
                    security-level auth-priv
                    security-entry se1 {
                        user user1 {
                        authentication {
                            protocol hmac-md5-96
                            password $aes1$AW/ZYq/e/AbNS28=$Dw3ipXdBawX9P10lfe/zAw==
                        }
                        privacy {
                            protocol cbc-des
                            password $aes1$AW9Bvh9EbJcvwm8=$V214DJcpHCvdxkWbewDVuQ==
                        }
                    }
                }
            }
            network-instance default {
                admin-state enable
            }
        }
    }