Setting Access Community Information
100
CopperLink CL2300 User Manual
13
• SNMP Configuration
Setting Access Community Information
SNMP uses one or more labels called
community strings
to delimit groups of
objects
(variables) that can be
viewed or modified on a CL2300. The SNMP data in such a group is organized in a tree structure called a
Management Information Base (MIB). A single device may have multiple MIBs connected together into one
large structure, and various community strings may provide read-only or read-write access to different, possibly
overlapping portions of the larger data structure. An example of a read-only variable might be a counter show-
ing the total number of octets sent or received through an interface. An example of a read-write variable might
be the speed of an interface, or the hostname of a CL2300.
Community strings also provide a weak form of access control in earlier versions of SNMP version 1 and 2.
SNMP version 3 provides much improved access control using strong authentication and should be preferred
over SNMP version 1 and 2 wherever it is supported. If a community string is defined, then it must be pro-
vided in any basic SNMP query if the requested operation is to be permitted by the CL2300. Community
strings usually allow read-only or read-write access to the CL2300. In some cases, a given community string
will be limited to one group of read-only or read-write objects described in an individual MIB.
In the absence of additional configuration options to constrain access, knowledge of the single community
string for the CL2300 is all that is required to gain access to all objects, both read-only and read-write, and to
modify any read-write objects.
Note
Security problems can be caused by unauthorized individuals possessing
knowledge of read-only community strings so they gain read access to confi-
dential information stored on an affected device. Worse can happen if they
gain access to read-write community strings that allow unauthorized remote
configuration of affected devices, possibly without the system administrators
being aware that changes are being made, resulting in a failure of integrity
and a possible failure of CL2300 availability. To prevent these situations,
define community strings that only allow read-only access to the MIB
objects should be the default.
Choosing community names is like choosing a password. Do not use easily guessed ones; do not use commonly
known words, mix letters and other characters, and so on. If you do not intend to allow anyone to use SNMP
write commands on your system, then you probably only need one community name.
This procedure describes how to define your own SNMP community.
Mode:
Configure
Step
Command
Purpose
1
device
(cfg)#snmp community
name
{ ro
|
rw }
Configures the SNMP community name with read-only
or read/write access
Use the no command option to remove a SNMP community setting.
Example:
Setting access community information
In the following example the SNMP communities for the default community public with read-only access and
the undisclosed community Not4evEryOne with read/write access are defined. Only these valid communities
have access to the information from the SNMP agent.