SNMP protocol
U
SER
G
UIDE
291
Access control (SNMPv3 users)
In the same way of the
community
, it is possible to create a user and establish its access mode, if in
read-only or read/write.
The creation of a user is made through the command:
set snmp user <username> auth MD5|SHA password <pass phrase>
while in order to establish the access mode, the command is:
set snmp user-access <username> ro|rw [auth|noauth|priv] [oid <value>]
where MD5 or SHA establishes the authentication mode,
<pass phrase>
is a password in which it
is possible to use spaces, for example: “My dog is called Fido”, and it must have 8 characters at
least or even more.
It is also possible to specify the level of security and the object identifier to which the access is
limited.
The security level can be accessed through authentication (
<pass phrase>
), or without
authentication or by forcing the usage of encryption.
It is possible to establish an encryption mode through the command:
set snmp user-priv <username> DES|AES [secret <priv pass phrase>]
where DES and AES are encryption protocols. If the optional parameter “
secret
” is not specified, the
same authentication
<pass phrase>
is used as
<priv pass phrase>
.
For example, if we want to create the user “tiesseuser” with access limited to “system” in read-only
and through authentication, the commands are:
set snmp user tiesseuser auth MD5 password my name is tiesseuser
set snmp user-access tiesseuser ro auth oid system
set snmp on
N.B.
: the SHA authentication and DES/AES protocols require a specific support of an encryption
element: this is OpenSSL and it is normally not present. In order activate this component, please
contact Tiesse service.
D
ISPLAYING
SNMP
CONFIGURATION
In order to display the sequence of commands used to configure Imola and the SNMP agent the
following
CLI
command is used:
show config current|saved|started
or
show config current | saved | started
The output will contain a section of commands relating to the SNMP parameters set on the router:
root@Imola>
show config current
set log remote 10.10.1.212
.
.
