Chapter 1: Product description
System management
Page 1-56
The default user
initial
will have read/write access to the whole of the MIB. This is described
View-based access control model
. The template users have no
access to the MIB in the default configuration. User
initial
will normally be used to create one
or more additional users with secret authentication and privacy keys, and with appropriate
access to the whole of the MIB or to particular views of the MIB according to the operator’s
security policy. New users must be created by cloning template users. The user
initial
may
then be deleted to prevent access using the well-known user name and keys. Alternatively, the
keys associated with
initial
may be set to some new secret value.
Web-based management of SNMPv3 security
PTP 670 supports an alternative, web-based approach for configuring SNMPv3 security. In this
case, the web-based interface allows users to specify SNMPv3 users, security levels, privacy
and authentication protocols, and passphrases. Web-based management will be effective for
many network applications, but the capabilities supported are somewhat less flexible than
those supported using the MIB-based security management.
Selection of web-based management for SNMPv3 security disables the MIB-based security
management.
Web-based management of SNMPv3 security allows for two security roles:
•
Read Only
•
System Administrator
Read Only and System Administrator users are associated with fixed views allowing access to
the whole of the MIB, excluding the objects associated with SNMPv3 security. System
Administrators have read/write access as defined in the standard and proprietary MIBs.
Web-based management of SNMPv3 security allows an operator to define the security levels
and protocols for each of the security roles; all users with the same role share a common
selection of security level and protocols.
Web-based security configuration is re-initialized when any of the following occurs:
•
All ODU configuration data is erased.
•
The SNMP Engine ID Format has been changed.
•
The SNMP Engine ID Format is Internet Address and the Internet Address has been
changed.
•
The SNMP Engine ID Format is Text String and the text string has been changed.
•
The SNMP Engine ID Format is MAC Address and configuration has been restored using a
file saved from a different unit.
•
SNMPv3 Security Management is changed from MIB-based to web-based.
Additionally, all SNMP user accounts are disabled when the authentication protocol, the
privacy protocol, or the security level is changed.
Downgrade of the license key
A possible lockout condition exists if a user downgrades the PTP 670 license key so as to
disable the AES capability when SNMPv3 users are configured with AES privacy and VACM is
configured to require privacy. In this case, recovery is by either (a) restoring the correct license
key, or (b) using recovery mode to rest all configuration and entering new configuration.
Option (b) will cause default users and access configuration to be re-created.
