Haivision F-MB21B-R, Руководство пользователя

Страница: 242 / 420

Configuring A/V Services Using SNMP
SNMPv3
Makito X User’s Guide, v2.2, Issue 02 242
SNMPv3
For SNMPv3, the definition of a user and its access permission are separate steps, whereas
for v1/v2c community-based security, a single command (e.g.,
nmcfg community
permit admin rw
) defines both.
The following command creates the user “johndoe” and defines its authentication protocol
and password, and its privacy (encryption) protocol and password.
These examples use MD5 for authentication and DES for privacy. They provide broader
compatibility but if your SNMP client supports SHA (authentication) and AES (privacy),
use these as they provide better security. (Note that you can type
nmcfg user help to view
the supported protocols and pass phrase restrictions.)
# nmcfg user define johndoe MD5 “password” DES “pass phrase”
The new user has no permissions until its access rights are defined. The command below
assigns the operator role to the user.
# nmcfg access usm permit johndoe operator auth
Note that the Makito X administrative user roles are preferred over the read-only or read-
write permissions (to the whole MIB). These roles provide to SNMP v1/v2c communities
and SNMPv3 users access privileges modeled on the Makito
X Accounts roles.
Examples
The following examples show how the v3 parameters are used with the SNMP commands.
The following get command has the required security level (authentication) and succeeds.
# snmpget –v3 –u johndoe –a MD5 –A “password” –l authNoPriv localhost
sysName.0
SNMPv2-MIB::sysName.0 = STRING: razor
#
The following
get
command provides no security (no authentication, no privacy) and fails.
# snmpget -v3 -u johndoe -l noAuthNoPriv localhost sysName.0
Error in packet
Reason: authorizationError (access denied to that object)
#
The following
set
command provides the highest security level (authentication and
privacy), even if access policy only required authentication, and succeeds.
# snmpset -v3 -u johndoe -a MD5 -A "password" -x DES -X "pass phrase" -l
authPriv localhost haiAvtStreamEncapsulation.1 i directRtp
HAI-AVT-STREAM-MIB::haiAvtStreamEncapsulation.1 = INTEGER:
directRtp(1)
#