blog
    SNMPv3 Tutorial
    19 July 08

    SNMPv3 Tutorial

    Posted byPetr Lapukhov
    facebooktwitterlinkedin
    news-featured

    The tutorial presented below is a small excerpt from the "System Management" section of beta IEWB-RS Vol I version 5.

    SNMPv3 protocol a security model, defining new concepts to replace the old community-based pseudo-authentication and provide communication privacy by means of encryption. The new concepts are: user, group and security level. A group defines the access policy for a set of users. An access policy defines which SNMP objects can be accessed for reading and writing or which SNMP objects can generate notifications to the members of a group. Policy is defined by associating the respective read, write or notify view with a group. By using a notify view, a group determines the list of notifications its users can receive. A group also defines the security model and security level for its users.

    Essentially, all groups form a table, which maps users to their read/write/notify views and security models. Note that if a group is defined without a read view than all objects are available to read. Contrary to that, if no write or notify view is defined, no write access is granted and no objects can send notifications to members of the group. The notify view is usually not configured manually. Rather, it’s added by the snmp-server host command automatically, when a users in a group is bound to a notification target host. Note that SNMP will use the username configured with snmp-server host along with the security model specified to authenticate and possibly encrypt the notifications. If the security model is set to «noauth» then a plain username is sent in a manner resembling the old community string.

    The following security models exist: SNMPv1, SNMPv2, SNMPv3. The following security levels exits: “noAuthNoPriv” (no authentiation and no encryption – noauth keyword in CLI), “AuthNoPriv” (messages are authenticated but not encrypted – auth keyword in CLI), “AuthPriv” (messages are authenticated and encrypted – priv keyword in CLI). SNMPv1 and SNMPv2 models only support the “noAuthNoPriv” model since they use plain community string to match the incoming packets. The SNMPv3 implementations could be configured to use either of the models on per-group basis (in case if “noAuthNoPriv” is configured, username serves as a replacement for community string). All users sharing a group utilize the same security model, however, the specific model settings (password, encryption key) are sep per-user. Note that SNMPv3 does not send passwords in clear-text and uses hash-based authentication with either MD5 or SHA1 functions (HMAC authentication – the packet conted is hashed along with authentication key to produce the authentication string). For encryption, statically configured keys are used along with DES56 symmetric cipher (that mean the same key should be configured on NMS for the particular user).

    Consider the example below. Three groups are created. Groups «NORMAL» and «RESTRICTED» are used to control remote users access and group «TRAP» is used to send notifications. Note that only read-view is specified for group "RESTRICTED" and it's limited to IfEntry fields for a fixed interface index. The group «RESTRICTED» has an access-list applied to control the NMS stations the users can access from. Note that the groups have different security levels. Next, three users are created, one for each group respectively, with their authentication and encryption keys. Finally, SNMP link up and down notifications are enabled and SNMP trap destination host is configured. This operation automatically creates and assigns the «notify» view for the respective group (will appear in show commands output below).

    !
    ! Access-List to control users in the RESTRICTED group.
    !
    access-list 99 permit 155.1.146.0 0.0.0.255

    !
    ! Set ifIndexes persistent, for view definition is based on IfIndexes
    !
    snmp-server ifindex persist

    !
    ! The first view covers the “ISO” sub-branch and the second one covers
    ! all “lifEntry” fields for interface with IfIndex 3 (Serial 0/0).
    !
    snmp-server view NORMAL iso included
    snmp-server view RESTRICTED ifEntry.*.3 included

    !
    ! Define three groups. The first one allows to read and write
    ! into a large portion of the MIB tree. The second one allows reading
    ! just information specific to Serial 0/0 interface, and limits user
    ! access based on access-list
    !
    ! The third group is for sending traps. A user belonging to this group
    ! will be utilized to send trap messages. Its name and password
    ! will be used to create authentication credentials in a trap message
    ! and the users privacy password will be used to encrypt the packet.
    ! Note that this group has NO notify view defined, which is done on
    ! on purpose. The notify view will be automatically populated when
    ! notification hosts are configured and bound to users
    !

    snmp-server group NORMAL v3 priv read NORMAL write NORMAL
    snmp-server group RESTRICTED v3 auth read RESTRICTED access 99
    snmp-server group TRAP v3 priv

    !
    ! Users, their passwords and encryption keys are defined now
    !
    snmp-server user NORMAL NORMAL v3 auth sha CISCO priv des56 CISCO
    snmp-server user RESTRICTED RESTRICTED v3 auth sha CISCO
    snmp-server user TRAP TRAP v3 auth sha CISCO priv des56 CISCO

    !
    ! Allow sending traps and configure a destination host. Note that when
    ! a host is configured and bound to SNMPv3 username, the corresponding
    ! group notify view is populated based on traps allowed for this
    ! particular destination. This is why it’s not required to configure
    ! the notify view for a group.
    !
    snmp-server enable traps snmp linkup linkdown
    snmp-server host 155.1.146.100 traps version 3 priv TRAP

    Perform some basic verifications next using the show commands. Note that SNMPv3 users do not appear in the running configuration for security reason (different management channel) but you can see some information using show snmp users command. Also, pay attention to the automatic view assigned to the “TRAP” group.

    Rack1R6#show snmp user 
    

    User name: TRAP
    Engine ID: 80000009030000119221DA80
    storage-type: nonvolatile active
    Authentication Protocol: SHA
    Privacy Protocol: DES
    Group-name: TRAP

    User name: NORMAL
    Engine ID: 80000009030000119221DA80
    storage-type: nonvolatile active
    Authentication Protocol: SHA
    Privacy Protocol: DES
    Group-name: NORMAL

    User name: RESTRICTED
    Engine ID: 80000009030000119221DA80
    storage-type: nonvolatile active
    Authentication Protocol: SHA
    Privacy Protocol: None
    Group-name: RESTRICTED

    Rack1R6#show snmp group
    groupname: ILMI security model:v1
    readview : *ilmi writeview: *ilmi
    notifyview:
    row status: active

    groupname: ILMI security model:v2c
    readview : *ilmi writeview: *ilmi
    notifyview:
    row status: active

    groupname: TRAP security model:v3 noauth
    readview : writeview:
    notifyview: *tv.FFFFFFFF.FFFFFFFF.FFFFFFFF0F
    row status: active

    groupname: TRAP security model:v3 priv
    readview : v1default writeview:
    notifyview:
    row status: active

    groupname: NORMAL security model:v3 priv
    readview : NORMAL writeview: NORMAL
    notifyview:
    row status: active

    groupname: RESTRICTED security model:v3 auth
    readview : RESTRICTED writeview:
    notifyview:
    row status: active access-list: 99

    Rack1R6#show snmp view
    *ilmi system - included permanent active
    *ilmi atmForumUni - included permanent active
    NORMAL iso - included nonvolatile active
    v1default iso - included permanent active
    v1default internet.6.3.15 - excluded permanent active
    v1default internet.6.3.16 - excluded permanent active
    v1default internet.6.3.18 - excluded permanent active
    v1default ciscoMgmt.394 - excluded permanent active
    v1default ciscoMgmt.395 - excluded permanent active
    v1default ciscoMgmt.399 - excluded permanent active
    v1default ciscoMgmt.400 - excluded permanent active
    RESTRICTED ifEntry.0.3 FF:EF included nonvolatile active
    *tv.FFFFFFFF.FFFFFFFF.FFFFFFFF0F iso.2.840.10036 - included volatile active
    *tv.FFFFFFFF.FFFFFFFF.FFFFFFFF0F internet - included volatile active

    Hey! Don’t miss anything - subscribe to our newsletter!

    © 2022 INE. All Rights Reserved. All logos, trademarks and registered trademarks are the property of their respective owners.
    instagram Logofacebook Logotwitter Logolinkedin Logoyoutube Logo