Allied Telesis SNMP Rel. 2.0.0 User manual

SNMP Reference Manual

Page 1 of 37

SNMP Reference Manual

SNMP Reference Manual Rel. 2.0.0

from Allied Telesis.

Allied Telesis reserves the right to make changes in specifications and other information contained in

this document without prior written notice. The information provided herein is subject to change

without notice. In no event shall Allied Telesis be liable for any incidental, special, indirect, or

consequential damages whatsoever, including but not limited to lost profits, arising out of or related to

this manual or the information contained herein, even if Allied Telesis has been advised of, known, or

should have known, the possibility of such damages.

All trademarks are the property of their respective owners.

SNMP Reference Manual

Page 2 of 37

Contents

INTRODUCTION TO SNMP CONFIGURATION ........................................................................................5

SNMP CONFIGURATION WITHIN THE SNMPV3 ADMINISTRATION FRAMEWORK .....................7

INTRODUCTION .........................................................................................................................7

SECURITY ...............................................................................................................................................................................7

MECHANISMS USED BY SNMPV3 SECURITY..............................................................................................................7

LOCAL CONFIGURATION DATASTORE .......................................................................................9

CONFIGURATION FILE FORMAT..................................................................................................................................9

CONFIGURATION FOR ALL SNMPV3 ENTITIES .......................................................................10

CONFIGURING SNMPV3 USERS...................................................................................................................................10

BREAKDOWN OF AN SNMPENGINEID....................................................................................................................11

CONFIGURING AN AGENT TO RECEIVE REQUESTS AND SEND TRAPS .............................................................................12

CONFIGURATION FOR AUTHENTICATION.......................................................................................................................12

CONFIGURATION FOR NO AUTHENTICATION ................................................................................................................13

ADDITIONAL CONFIGURATION FOR SNMPV3 AGENT ENTITIES .............................................13

CONFIGURING VIEW-BASED ACCESS CONTROL...............................................................................................13

DEFINING FAMILIES OF VIEW SUBTREES..................................................................................................................13

DEFINING GROUPS AND ACCESS RIGHTS .............................................................................................................15

ASSIGNING PRINCIPALS TO GROUPS.......................................................................................................................16

CONFIGURING NOTICATIONS..................................................................................................17

DEFINING NOTIFICATIONS..........................................................................................................................................17

DEFINING TARGET ADDRESSES..................................................................................................................................18

SNMP Reference Manual

Page 3 of 37

DEFINING TARGET PARAMETERS...............................................................................................................................19

CONFIGURING NOTIFICATION FILTERS....................................................................................20

CREATING A NOTIFICATION FILTER .......................................................................................................................20

ASSOCIATING A FILTER WITH A NOTIFICATION PARAMETER.....................................................................22

CONFIGURING SOURCE ADDRESS CHECKING...........................................................................23

MATCHING EXACTLY ONE SOURCE ADDRESS ...................................................................................................25

MATCHING ANY SOURCE ADDRESS ........................................................................................................................25

MATCHING A SOURCE ADDRESS IN A SUBNET ..................................................................................................25

EXAMPLES............................................................................................................................................................ 27

NOAUTHNOPRIV SNMPV3 USERS .........................................................................................27

AUTHNOPRIV SNMPV3 USERS ...............................................................................................28

ADDITIONAL CONFIGURATION FOR SNMPV3 AGENT ENTITIES .............................................29

CONFIGURING CONTEXT NAMES............................................................................................................................29

ADDITIONAL CONFIGURATION FOR SNMPV1 AND SNMPV2 AGENT ENTITIES.....................30

CONFIGURING COMMUNITIES...................................................................................................................................30

EXAMPLES ............................................................................................................................................................................31

MIB ..........................................................................................................................................................................................33

STANDARD (PUBLIC) MIB .......................................................................................................33

STANDARD TRAPS ...........................................................................................................................................................34

ENTERPRISE (PRIVATE) MIB ....................................................................................................34

PRIVATE TRAPS ..................................................................................................................................................................35

SNMP Reference Manual

Page 4 of 37

Tables

Table 1 - registered snmpEngineID for AT-RG600.......................................................................................... 12

Table 2 – limitations to support of the standard MIB...................................................................................... 34

Table 3 – the sysInfo group ................................................................................................................................... 34

Table 4 - the sysUsers group ............................................................................................................................... 35

Table 5 – the sysAdmin group .............................................................................................................................. 35

Table 6 – Private Traps........................................................................................................................................... 36

Figures

Figure 1 - A manager Entity ..................................................................................................................................... 5

Figure 2 - An agent Entity......................................................................................................................................... 6

Figure 3 - HMAC expression .................................................................................................................................. 8

Figure 4 - vacmViewTreeFamilyMask .................................................................................................................. 14

Figure 5 – vacmViewTreeFamilyMask continued .............................................................................................. 15

Figure 6 - snmpNotifyFilterMask .......................................................................................................................... 21

Figure 7 - snmpNotifyFilterMask continued....................................................................................................... 22

Figure 8 - snmpTargetAddrTMask ....................................................................................................................... 25

Figure 9 ...................................................................................................................................................................... 25

Figure 10 .................................................................................................................................................................... 25

Figure 11 .................................................................................................................................................................... 26

Figure 12 .................................................................................................................................................................... 26

SNMP Reference Manual

Introduction to SNMP configuration Page 5 of 37

Introduction to SNMP configuration

This chapter introduces the configuration of SNMP module on AT-RG600 Residential Gateway family.

To describe the SNMP configuration process the following terminology is used:

• ENTITY

a network management element that consists of an SNMP engine and one or more applications.

• ENGINE

a component of an SNMP entity that consists of a message processing subsystem, a security

subsystem, an access control subsystem (as appropriate), and a dispatcher.

• APPLICATION

a component of an SNMP entity that determines the function of the entity. Applications include a

command generator, command responder, notification originator, notification receiver, proxy

forwarder, etc.

The SNMP entity that is commonly called a MANAGER is an engine plus a command generator application

and a notification receiver application.

FIGURE 1- A MANAGER ENTITY

SNMP Reference Manual

Introduction to SNMP configuration Page 6 of 37

The SNMP entity that is commonly called an AGENT is an engine plus a command responder and a

notification originator. Other types of entities are possible, because other combinations of engine and

applications are viable.

FIGURE 2- AN AGENT ENTITY

SNMP Reference Manual

SNMP configuration within the SNMPv3 administration framework Page 7 of 37

SNMP configuration within the SNMPv3

administration framework

The SNMPv3 Administration Framework is a configuration infrastructure for SNMPv3 users, but it can

also be used to remotely configure and administer SNMPv1 and SNMPv2c community strings.

Introduction

The SNMPv3 security administration framework provides a strong authentication mechanism,

authorization with fine granularity, complete access control, security level controls which include two

authentication algorithms1and an optional privacy protocol, and a MIB document for remote

configuration.

Security

SNMPv3 provides advanced security mechanisms for protecting against threats to management

operations. These security mechanisms are not new: they are taken from the SNMPv2 Draft Standards.

The following sections describe the potential threats and how SNMPv3 protects against these threats.

SNMPv3 addresses in particular the following four threats:

• MASQUERADE

the masquerade threat is when an unauthorized user attempts to carry out management operations

by assuming the identity of an authorized user. SNMPv3 can verify the identity of the originator of

the SNMPv3 message.

• MODIFICATION OF INFORMATION

modification of information is the threat that a user will (by malice or error) alter a message in

transit between the source and the destination, thereby carrying out unauthorized management

activity. SNMPv3 can verify that the SNMPv3 message was not altered in transit between the

originator and the recipient.

• MESSAGE STREAM MODIFICATION

message stream modification occurs when (by malice or error) management messages are

reordered, replayed, or delayed. SNMPv3 can verify that a received message is timely.

Mechanisms used by SNMPv3 security

SNMPv3 security protects against masquerade, modification of information, and message

stream modification by using the Hash-based Message Authentication Code (HMAC) with MD5

Message Digest Algorithm (MD5) in a symmetric, i.e. private, key mode. MD5, defined in

1Trivial authentication requiring only a correct user names and strong authentication based on an MD5 hash algorithm.

SNMP Reference Manual

SNMP configuration within the SNMPv3 administration framework Page 8 of 37

RFC1321, takes “as input a message of arbitrary length and produces as output a fingerprint or ‘message

digest’ of the input.”

HMAC, defined in RFC2104,

• computes an MD5 hash (H)on the concatenation of

(a) the shared secret key (K), which has been XORed with the hexadecimal value ‘36 ’(ipad),

and

(b) the SNMP message (text), which contains zero bytes in the digest field, to produce an

intermediate digest, and

• computes an MD5 hash on the concatenation of

(a) the shared secret key, which has been XORed with the hexadecimal value ‘5C ’(opad),

and

(b) the intermediate digest to produce the final digest.

The HMAC function is summarized by the following expression:

FIGURE 3- HMAC EXPRESSION

HMAC is used in the following manner to protect against threats to management operations:

• The sender and intended recipient of the SNMPv3 message share a secret key.

• When the sender constructs the outgoing message, the sender’s notion of the SNMP agent ’s time is

inserted into the message, and the digest field is padded with zeros. The HMAC function is then used

to compute a digest (“fingerprint”) over the concatenation of the sender ’s notion of the shared

secret key and SNMPv3 message.

• The digest is then inserted into the message at the position where the padding previously had been.

• The message is then sent.

• When the recipient receives the message, the digest in the incoming message is saved.

• The recipient inserts zeros into the incoming message at the position where the shared secret key

previously had been.

• In the same manner as the sender, the recipient uses HMAC to compute a digest of the incoming

message (with padding instead of a digest) and the recipient ’s notion of the shared secret key.

The recipient then compares:

• the digest computed over the incoming message,

• the digest that was saved from the incoming message.

If the shared secret key has not been compromised2, and if the two digests above exactly match, then

there is a high degree of confidence3that the following statements about the message are true:

2SNMPv3 cannot protect against the threat of compromised keys. If an unauthorized user knows a shared secret key, then that user can masquerade as another user, modify

messages in transit, and modify the message stream.

SNMP Reference Manual

SNMP configuration within the SNMPv3 administration framework Page 9 of 37

• The message origin is authentic. That is, the user that claims to have sent the message did in fact

send it. Otherwise, the digests would have been different.

• The message contents have not been altered in transit. Otherwise, the digests would have been

different.

When an SNMP agent receives a message, it verifies that the received message is timely by comparing

the time value inside the packet with the current time. If the time value from the packet is within a “safe

”window of the actual current time, the packet is accepted. If the time value from the packet is not

within the specified window, a Report PDU containing the agent ’s notion of current time is transmitted

to the sender of the received packet, and the agent discards the received packet.

If the original message was authentic, then the sender of the original message has the ability to resend

the request. The sender of the original message will update its notion of the SNMP agent ’s time using

the time value from the Report PDU. Then, the HMAC calculations will be performed again to obtain

the digest for the same request packet containing an updated time value.

If the original message was the result of message stream modification, and if the shared secret key has

not been compromised, then the sender would not find the time value from the Report PDU to be

useful. Without the secret key, the packet digest cannot be correctly recalculated.

Local configuration datastore

SNMP configuration information must be stored locally on the Residential Gateway filesystem in a plain

ASCII text file named snmpd.cnf.

It's possible upload such file via a ftp session (using the ftp daemon facility available on the Residential

Gateway) or via the swupdate feature.

Configuration file format

Each line of the configuration file has the format <TAG> <VALUE> where <TAG> is a keyword and

<VALUE> is a valid configuration value.

Entries may be continued across multiple lines by using a backslash ( \). White space (tabs, spaces, line-

feeds/carriage-returns) and blank lines in the file are ignored. Values that are strings containing white

space must be delimited with quotation marks (").

3It is computationally infeasible to threaten a system by trying all possible keys,especially if the administration policy for the system includes a periodic changing of the keys

which are configured.

This manual suits for next models

Table of contents

Other Allied Telesis Software manuals

Allied Telesis

Allied Telesis AT-S82 User manual

Allied Telesis

Allied Telesis 86222-25 Instruction Manual

Allied Telesis

Allied Telesis AT-S87 Instruction Manual

Allied Telesis

Allied Telesis AT-8000S Series User manual

Allied Telesis

Allied Telesis 86222-10 How to use

Allied Telesis

Allied Telesis AT-8948 User manual

Allied Telesis

Allied Telesis AT-x900-12XT/S User manual

Allied Telesis

Allied Telesis 86253-07 Instruction Manual

Allied Telesis

Allied Telesis Broadcom Advanced Control Suite 3 User manual

Allied Telesis

Allied Telesis AR44xS Instruction Manual

Allied Telesis

Allied Telesis AR4155 Instruction Manual

Allied Telesis

Allied Telesis SB251-13 Instruction Manual

Allied Telesis

Allied Telesis AT-S95 User manual

Allied Telesis

Allied Telesis AR44xS Instruction Manual

Allied Telesis

Allied Telesis AT-9400 User manual

Allied Telesis

Allied Telesis AT-S95 User manual

Allied Telesis

Allied Telesis AT-S39 User manual

Allied Telesis

Allied Telesis 86241-01 Instruction Manual

Allied Telesis

Allied Telesis AT-S79 User manual

Allied Telesis

Allied Telesis AT-8600 Series Instruction Manual

Allied Telesis

Allied Telesis WebSmart AT-FS750/16 How to use

Allied Telesis

Allied Telesis SwitchBlade AT-AR440S User manual

Allied Telesis

Allied Telesis AR770S Installation guide

Allied Telesis

Allied Telesis SwitchBlade AT-AR440S User manual

Popular Software manuals by other brands

COMPRO

COMPRO COMPROFM manual

Muratec

Muratec OFFICEBRIDGE ONLINE user guide

Oracle

Oracle Contact Center Anywhere 8.1 installation guide

Adobe

Adobe 65007312 - Photoshop Lightroom Programmer's guide

Avaya

Avaya NULL One-X for RIM Blackberry user guide

HP ProLiant BL420c user guide

PS Audio

PS Audio PowerPlay Programming manual

Brady

Brady LOCKOUT PRO 3.0 Administrator's guide

Avaya

Avaya Interaction Center user guide

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Guide book

Novell

Novell GROUPWISE 8 - INTERNET AGENT manual

Oracle

Oracle Application 9i Configuration guide

Acer

Acer RDM user guide

Canon

Canon Vixia HF21 instruction manual

Canon

Canon ZR950 instruction manual

Samsung

Samsung Auto Backup user manual

Polycom

Polycom Vortex EF2201 Application note

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c user manual