You also can enable or disable authentication traps for SNMP packets dropped due to VRF mismatches. By
default if SNMP authentication traps are enabled, VRF authentication traps are also enabled.
VPN Route Distinguishers
A route distinguisher (RD) creates routing and forwarding tables and specifies the default route distinguisher
for a VPN. The RD is added to the beginning of the customer
’
s IPv4 prefixes to change them into globally
unique VPN-IPv4 prefixes.
The RD is either an autonomous system number (ASN)-relative RD, in which case it comprises an autonomous
system number and an arbitrary number, or it is an IP-address-relative RD, in which case it comprises an IP
address and an arbitrary number.
You can enter an RD in either of these formats:
•
16-bit ASN: your 16-bit number: For example, 101:3.
•
32-bit IP address: your 32-bit number: For example, 192.168.122.15:1.
SNMP Contexts
SNMP contexts provide VPN users with a secure way of accessing MIB data. When a VPN is associated with
a context, that VPN
’
s specific MIB data exists in that context. Associating a VPN with a context enables
service providers to manage networks with multiple VPNs. Creating and associating a context with a VPN
enables a provider to prevent the users of one VPN from accessing information about other VPN userss on
the same networking device.
VPN-aware SNMP requires an agreement between SNMP manager and agent entities operating in a VPN
environment on a mapping between the SNMP security name and the VPN ID. This mapping is created by
using multiple contexts for the SNMP data of different VPNs through the configuration of the
SNMP-VACM-MIB. The SNMP-VACM-MIB is configured with views so that a user on a VPN with a security
name is allowed access to the restricted object space associated with a user
’
s access type in the context
associated with the user of that VPN.
SNMP request messages undergo three phases of security and access control before a response message is
sent back with the object values in the context of a VPN:
•
In the first phase, the username is authenticated. This phase ensures that the user is authenticated and
authorized for SNMP access.
•
In the second phase, the user is authorized for the SNMP access requested to the group objects under
consideration of the configured SNMP context. This phase is called the access control phase.
•
In the third phase, access is made to a particular instance of a table entry. With this third phase, complete
retrieval can be based on the SNMP context name.
Cisco cBR Series Converged Broadband Routers Troubleshooting and Network Management Configuration Guide
for Cisco IOS XE Fuji 16.8.x
71
SNMP Support over VPNs
—
Context-Based Access Control
SNMP Contexts