Extreme Networks ExtremeWare XOS 10.1, Manual

Page: 44 / 256

44 ExtremeWare XOS 10.1 Concepts Guide
Managing the Switch
Users are associated with groups using the following command:
configure snmpv3 add group {hex} <group_name> user {hex} <user_name> {sec-model
[snmpv1| snmpv2 | usm]} {volatile}
To show which users are associated with a group, use the following command:
show snmpv3 group {{hex} <group_name> {user {hex} <user_name>}}
To delete a group, use the following command:
configure snmpv3 delete access [all-non-defaults | {{hex} <group_name> {sec-model
[snmpv1 | snmpv2c | usm] sec-level [noauth | authnopriv | priv]}}]
When you delete a group, you do not remove the association between the group. To delete the
association between a user and a group, use the following command:
configure snmpv3 delete group {{hex} <group_name>} user [all-non-defaults | {{hex}
<user_name> {sec-model [snmpv1|snmpv2c|usm]}}]
Security Models and Levels. For compatibility, SNMPv3 supports three security models:
• SNMPv1—no security
• SNMPv2c—community strings based security
• SNMPv3—USM security
The default is User-Based Security Model (USM). You can select the security model based on the
network manager in your network.
The three security levels supported by USM are:
• noAuthnoPriv—No authentication, no privacy. This is the case with existing SNMPv1/v2c agents.
• AuthnoPriv—Authentication, no privacy. Messages are tested only for authentication.
• AuthPriv—Authentication, privacy. This represents the highest level of security and requires every
message exchange to pass the authentication and encryption tests.
When a user is created, an authentication method is selected, and the authentication and privacy
passwords or keys are entered.
When MD5 authentication is specified, HMAC-MD5-96 is used to achieve authentication with a 16-octet
key, which generates an 128-bit authorization code. This code is inserted in
msgAuthenticationParameters field of SNMPv3 PDUs when the security level is specified as either
AuthnoPriv or AuthPriv. Specifying SHA authentication uses the HMAC-SHA protocol with a 20-octet
key for authentication.
For privacy, a 16-octet key is provided as input to DES-CBS encryption protocol, which generates an
encrypted PDU to be transmitted. DES uses bytes 1-7 to make a 56 bit key. This key (encrypted itself) is
placed in msgPrivacyParameters of SNMPv3 PDUs when the security level is specified as AuthPriv.
MIB Access Control
SNMPv3 provides a fine-grained mechanism for defining which parts of the MIB can be accessed. This
is referred to as the View-Based Access Control Model (VACM).
MIB views represent the basic building blocks of VACM. They are used to define a subset of the
information in the MIB. Access to read, to write, and to generate notifications is based on the