MNS-BB
Software User Guide
-40-
v
v3
authNoPriv
MD5
No
Provides authentication based on the
HMAC-MD5 or HMAC-SHA algorithms.
v3
authPriv
MD5
DES
Provides authentication based on the
HMAC-MD5 or HMAC-SHA algorithms.
Provides DES 56-bit encryption in
addition to authentication based on the
CBC-DES (DES-56) stand
Note the following about SNMPv3 objects:
•
Each user belongs to a group.
•
A group defines the access policy for a set of users.
•
An access policy is what SNMP objects can be accessed for reading, and writing.
•
A group determines the list of notifications its users can receive.
•
A group also defines the security model and security level for its users.
8.9.1 Benefits
•
Data can be collected securely from SNMP devices without fear of the data being tampered with or
corrupted.
•
Confidential information, for example, SNMP Set command packets that change a router's
configuration, can be encrypted to prevent its contents from being exposed on the network.
8.9.2
List of Terms
authentication
---The process of ensuring message integrity and protection against message replays.
It includes both data integrity and data origin authentication.
authoritative SNMP engine
---One of the SNMP copies involved in network communication
designated to be the allowed SNMP engine to protect against message replay, delay, and redirection.
The security keys used for authenticating and encrypting SNMPv3 packets are generated as a function
of the authoritative SNMP engine's engine ID and user passwords. When an SNMP message expects
a response (for example, get exact, get next, set request), the
receiver
of these messages is
authoritative. When an SNMP message does not expect a response, the
sender
is authoritative.
community string
---A text string used to authenticate messages between a management station and
an SNMP v1/v2c engine.
data integrity
---A condition or state of data in which a message packet has not been altered or
destroyed in an unauthorized manner.
data origin authentication
---The ability to verify the identity of a user on whose behalf the message
is supposedly sent. This ability protects users against both message capture and replay by a different
SNMP engine, and against packets received or sent to a particular user that use an incorrect password
or security level.
encryption
---A method of hiding data from an unauthorized user by scrambling the contents of an
SNMP packet.
group
---A set of users belonging to a particular security model. A group defines the access rights for
all the users belonging to it. Access rights define what SNMP objects can be read, written to, or
created. In addition, the group defines what notifications a user is allowed to receive.
notification host
---An SNMP entity to which notifications (traps and informs) are to be sent.
notify view
---A view name (not to exceed 64 characters) for each group that defines the list of
notifications that can be sent to each user in the group.
