Allied Telesis SNMP Rel. 2.0.0 User manual

SNMP Reference Manual

SNMP Reference Manual
Page 1 of 37
SNMP Reference Manual
SNMP Reference Manual Rel. 2.0.0
Copyright © 2004 Allied Telesis
All rights reserved. No part of this publication may be reproduced without prior written permission
from Allied Telesis.
Allied Telesis reserves the right to make changes in specifications and other information contained in
this document without prior written notice. The information provided herein is subject to change
without notice. In no event shall Allied Telesis be liable for any incidental, special, indirect, or
consequential damages whatsoever, including but not limited to lost profits, arising out of or related to
this manual or the information contained herein, even if Allied Telesis has been advised of, known, or
should have known, the possibility of such damages.
All trademarks are the property of their respective owners.

SNMP Reference Manual
Page 2 of 37
Contents
INTRODUCTION TO SNMP CONFIGURATION ........................................................................................5
SNMP CONFIGURATION WITHIN THE SNMPV3 ADMINISTRATION FRAMEWORK .....................7
INTRODUCTION .........................................................................................................................7
SECURITY ...............................................................................................................................................................................7
MECHANISMS USED BY SNMPV3 SECURITY..............................................................................................................7
LOCAL CONFIGURATION DATASTORE .......................................................................................9
CONFIGURATION FILE FORMAT..................................................................................................................................9
CONFIGURATION FOR ALL SNMPV3 ENTITIES .......................................................................10
CONFIGURING SNMPV3 USERS...................................................................................................................................10
BREAKDOWN OF AN SNMPENGINEID....................................................................................................................11
CONFIGURING AN AGENT TO RECEIVE REQUESTS AND SEND TRAPS .............................................................................12
CONFIGURATION FOR AUTHENTICATION.......................................................................................................................12
CONFIGURATION FOR NO AUTHENTICATION ................................................................................................................13
ADDITIONAL CONFIGURATION FOR SNMPV3 AGENT ENTITIES .............................................13
CONFIGURING VIEW-BASED ACCESS CONTROL...............................................................................................13
DEFINING FAMILIES OF VIEW SUBTREES..................................................................................................................13
DEFINING GROUPS AND ACCESS RIGHTS .............................................................................................................15
ASSIGNING PRINCIPALS TO GROUPS.......................................................................................................................16
CONFIGURING NOTICATIONS..................................................................................................17
DEFINING NOTIFICATIONS..........................................................................................................................................17
DEFINING TARGET ADDRESSES..................................................................................................................................18

SNMP Reference Manual
Page 3 of 37
DEFINING TARGET PARAMETERS...............................................................................................................................19
CONFIGURING NOTIFICATION FILTERS....................................................................................20
CREATING A NOTIFICATION FILTER .......................................................................................................................20
ASSOCIATING A FILTER WITH A NOTIFICATION PARAMETER.....................................................................22
CONFIGURING SOURCE ADDRESS CHECKING...........................................................................23
MATCHING EXACTLY ONE SOURCE ADDRESS ...................................................................................................25
MATCHING ANY SOURCE ADDRESS ........................................................................................................................25
MATCHING A SOURCE ADDRESS IN A SUBNET ..................................................................................................25
EXAMPLES............................................................................................................................................................ 27
NOAUTHNOPRIV SNMPV3 USERS .........................................................................................27
AUTHNOPRIV SNMPV3 USERS ...............................................................................................28
ADDITIONAL CONFIGURATION FOR SNMPV3 AGENT ENTITIES .............................................29
CONFIGURING CONTEXT NAMES............................................................................................................................29
ADDITIONAL CONFIGURATION FOR SNMPV1 AND SNMPV2 AGENT ENTITIES.....................30
CONFIGURING COMMUNITIES...................................................................................................................................30
EXAMPLES ............................................................................................................................................................................31
MIB ..........................................................................................................................................................................................33
STANDARD (PUBLIC) MIB .......................................................................................................33
STANDARD TRAPS ...........................................................................................................................................................34
ENTERPRISE (PRIVATE) MIB ....................................................................................................34
PRIVATE TRAPS ..................................................................................................................................................................35

SNMP Reference Manual
Page 4 of 37
Tables
Table 1 - registered snmpEngineID for AT-RG600.......................................................................................... 12
Table 2 – limitations to support of the standard MIB...................................................................................... 34
Table 3 – the sysInfo group ................................................................................................................................... 34
Table 4 - the sysUsers group ............................................................................................................................... 35
Table 5 – the sysAdmin group .............................................................................................................................. 35
Table 6 – Private Traps........................................................................................................................................... 36
Figures
Figure 1 - A manager Entity ..................................................................................................................................... 5
Figure 2 - An agent Entity......................................................................................................................................... 6
Figure 3 - HMAC expression .................................................................................................................................. 8
Figure 4 - vacmViewTreeFamilyMask .................................................................................................................. 14
Figure 5 – vacmViewTreeFamilyMask continued .............................................................................................. 15
Figure 6 - snmpNotifyFilterMask .......................................................................................................................... 21
Figure 7 - snmpNotifyFilterMask continued....................................................................................................... 22
Figure 8 - snmpTargetAddrTMask ....................................................................................................................... 25
Figure 9 ...................................................................................................................................................................... 25
Figure 10 .................................................................................................................................................................... 25
Figure 11 .................................................................................................................................................................... 26
Figure 12 .................................................................................................................................................................... 26

SNMP Reference Manual
Introduction to SNMP configuration Page 5 of 37
Introduction to SNMP configuration
This chapter introduces the configuration of SNMP module on AT-RG600 Residential Gateway family.
To describe the SNMP configuration process the following terminology is used:
• ENTITY
a network management element that consists of an SNMP engine and one or more applications.
• ENGINE
a component of an SNMP entity that consists of a message processing subsystem, a security
subsystem, an access control subsystem (as appropriate), and a dispatcher.
• APPLICATION
a component of an SNMP entity that determines the function of the entity. Applications include a
command generator, command responder, notification originator, notification receiver, proxy
forwarder, etc.
The SNMP entity that is commonly called a MANAGER is an engine plus a command generator application
and a notification receiver application.
FIGURE 1- A MANAGER ENTITY

SNMP Reference Manual
Introduction to SNMP configuration Page 6 of 37
The SNMP entity that is commonly called an AGENT is an engine plus a command responder and a
notification originator. Other types of entities are possible, because other combinations of engine and
applications are viable.
FIGURE 2- AN AGENT ENTITY

SNMP Reference Manual
SNMP configuration within the SNMPv3 administration framework Page 7 of 37
SNMP configuration within the SNMPv3
administration framework
The SNMPv3 Administration Framework is a configuration infrastructure for SNMPv3 users, but it can
also be used to remotely configure and administer SNMPv1 and SNMPv2c community strings.
Introduction
The SNMPv3 security administration framework provides a strong authentication mechanism,
authorization with fine granularity, complete access control, security level controls which include two
authentication algorithms1and an optional privacy protocol, and a MIB document for remote
configuration.
Security
SNMPv3 provides advanced security mechanisms for protecting against threats to management
operations. These security mechanisms are not new: they are taken from the SNMPv2 Draft Standards.
The following sections describe the potential threats and how SNMPv3 protects against these threats.
SNMPv3 addresses in particular the following four threats:
• MASQUERADE
the masquerade threat is when an unauthorized user attempts to carry out management operations
by assuming the identity of an authorized user. SNMPv3 can verify the identity of the originator of
the SNMPv3 message.
• MODIFICATION OF INFORMATION
modification of information is the threat that a user will (by malice or error) alter a message in
transit between the source and the destination, thereby carrying out unauthorized management
activity. SNMPv3 can verify that the SNMPv3 message was not altered in transit between the
originator and the recipient.
• MESSAGE STREAM MODIFICATION
message stream modification occurs when (by malice or error) management messages are
reordered, replayed, or delayed. SNMPv3 can verify that a received message is timely.
Mechanisms used by SNMPv3 security
SNMPv3 security protects against masquerade, modification of information, and message
stream modification by using the Hash-based Message Authentication Code (HMAC) with MD5
Message Digest Algorithm (MD5) in a symmetric, i.e. private, key mode. MD5, defined in
1Trivial authentication requiring only a correct user names and strong authentication based on an MD5 hash algorithm.

SNMP Reference Manual
SNMP configuration within the SNMPv3 administration framework Page 8 of 37
RFC1321, takes “as input a message of arbitrary length and produces as output a fingerprint or ‘message
digest’ of the input.”
HMAC, defined in RFC2104,
• computes an MD5 hash (H)on the concatenation of
(a) the shared secret key (K), which has been XORed with the hexadecimal value ‘36 ’(ipad),
and
(b) the SNMP message (text), which contains zero bytes in the digest field, to produce an
intermediate digest, and
• computes an MD5 hash on the concatenation of
(a) the shared secret key, which has been XORed with the hexadecimal value ‘5C ’(opad),
and
(b) the intermediate digest to produce the final digest.
The HMAC function is summarized by the following expression:
FIGURE 3- HMAC EXPRESSION
HMAC is used in the following manner to protect against threats to management operations:
• The sender and intended recipient of the SNMPv3 message share a secret key.
• When the sender constructs the outgoing message, the sender’s notion of the SNMP agent ’s time is
inserted into the message, and the digest field is padded with zeros. The HMAC function is then used
to compute a digest (“fingerprint”) over the concatenation of the sender ’s notion of the shared
secret key and SNMPv3 message.
• The digest is then inserted into the message at the position where the padding previously had been.
• The message is then sent.
• When the recipient receives the message, the digest in the incoming message is saved.
• The recipient inserts zeros into the incoming message at the position where the shared secret key
previously had been.
• In the same manner as the sender, the recipient uses HMAC to compute a digest of the incoming
message (with padding instead of a digest) and the recipient ’s notion of the shared secret key.
The recipient then compares:
• the digest computed over the incoming message,
• the digest that was saved from the incoming message.
If the shared secret key has not been compromised2, and if the two digests above exactly match, then
there is a high degree of confidence3that the following statements about the message are true:
2SNMPv3 cannot protect against the threat of compromised keys. If an unauthorized user knows a shared secret key, then that user can masquerade as another user, modify
messages in transit, and modify the message stream.

SNMP Reference Manual
SNMP configuration within the SNMPv3 administration framework Page 9 of 37
• The message origin is authentic. That is, the user that claims to have sent the message did in fact
send it. Otherwise, the digests would have been different.
• The message contents have not been altered in transit. Otherwise, the digests would have been
different.
When an SNMP agent receives a message, it verifies that the received message is timely by comparing
the time value inside the packet with the current time. If the time value from the packet is within a “safe
”window of the actual current time, the packet is accepted. If the time value from the packet is not
within the specified window, a Report PDU containing the agent ’s notion of current time is transmitted
to the sender of the received packet, and the agent discards the received packet.
If the original message was authentic, then the sender of the original message has the ability to resend
the request. The sender of the original message will update its notion of the SNMP agent ’s time using
the time value from the Report PDU. Then, the HMAC calculations will be performed again to obtain
the digest for the same request packet containing an updated time value.
If the original message was the result of message stream modification, and if the shared secret key has
not been compromised, then the sender would not find the time value from the Report PDU to be
useful. Without the secret key, the packet digest cannot be correctly recalculated.
Local configuration datastore
SNMP configuration information must be stored locally on the Residential Gateway filesystem in a plain
ASCII text file named snmpd.cnf.
It's possible upload such file via a ftp session (using the ftp daemon facility available on the Residential
Gateway) or via the swupdate feature.
Configuration file format
Each line of the configuration file has the format <TAG> <VALUE> where <TAG> is a keyword and
<VALUE> is a valid configuration value.
Entries may be continued across multiple lines by using a backslash ( \). White space (tabs, spaces, line-
feeds/carriage-returns) and blank lines in the file are ignored. Values that are strings containing white
space must be delimited with quotation marks (").
3It is computationally infeasible to threaten a system by trying all possible keys,especially if the administration policy for the system includes a periodic changing of the keys
which are configured.