3Com Switch 7757, Configuration Manual

Page: 80 / 940

80 C
HAPTER
8: U
SER
C
ONTROL
n
You can specify different ACLs while configuring the SNMP community name, the
SNMP group name, and the SNMP user name.
As SNMP community name is a feature of SNMPv1 and SNMPv2c, the specified
ACLs in the command that configures SNMP community names (the
snmp-agent
community command) take effect in the network management systems that
adopt SNMPv1 or SNMPv2c.
Similarly, as SNMP group name and SNMP user are features of SNMPv2c and the
higher SNMP versions, the specified ACLs in the commands that configure SNMP
group names and SNMP user names take effect in the network management
systems that adopt SNMPv2c or higher SNMP versions. If you specify ACLs in the
two commands, the network management users are filtered by both SNMP group
name and SNMP user name.
Configuration Example Network requirements
Only SNMP users sourced from the IP addresses of 10.110.100.52 and
10.110.100.46 are permitted to access the switch.
Network diagram
Figure 23 Network diagram for controlling SNMP users using ACLs
Configuration procedure
# Define a basic ACL.
<SW7750> system-view
[SW7750] acl number 2000 match-order config
[SW7750-acl-basic-2000] rule 1 permit source 10.110.100.52 0
[SW7750-acl-basic-2000] rule 2 permit source 10.110.100.46 0
[SW7750-acl-basic-2000] rule 3 deny source any
[SW7750-acl-basic-2000] quit
# Apply the ACL to only permit SNMP users sourced from the IP addresses of
10.110.100.52 and 10.110.100.46 to access the switch.
[SW7750] snmp-agent community read aaa acl 2000
[SW7750] snmp-agent group v2c groupa acl 2000
[SW7750] snmp-agent usm-user v2c usera groupa acl 2000
Controlling Web Users
by Source IP Address
You can manage a Switch 7750 remotely through Web. Web users can access a
switch through HTTP connections.
Switch
10.110.100.46
Host A
IP network
Host B
10.110.100.52