Tip

This is the documentation for the 20.02 version. Looking for the documentation of the latest version? Have a look here.

SNMP Configuration¶

The SNMP configuration is managed using the snmp command from config mode. This command has several options which are collectively used to define VACM rules to grant access to clients.

Note

TNSR automatically restarts the SNMP service when making changes to the SNMP configuration. The SNMP service will be momentarily unavailable while the service is reloading with the new configuration.

Tip

Basic system information for SNMP such as contact (sysContact), location (sysLocation), description (sysDescr), and hostname (sysName) is pulled from the values configured using the system command. See Basic System Information for information on setting these values.

SNMP Communities¶

An SNMP community in SNMPv1 and SNMPv2c is similar to a username and password in a single string. The community name is given by a client and checked against communities listed in the SNMP configuration. If the community is known, and the source of the request matches the source defined for the community, then the request continues on to have its access checked further.

Warning

SNMPv1 and SNMPv2c are not encrypted. Only allow access to the SNMP daemon from management networks or similar secure locations.

A community entry maps a traditional SNMP community name (e.g. public) to a VACM security name:

tnsr(config)# [no] snmp community community-name <community-name>
                                  source (<src-prefix>|default)
                                  security-name <security-name>

The following parameters are available:

community-name <community-name>:

The name for this community.

Warning

The SNMP community name should be considered as a password. Do not use an easily guessed name, and keep the community name a secret from others. Do not transmit the community name over an insecure network.

source (<src-prefix>|default):

The IPv4 or IPv6 source network from which requests for this community will originate. For example, a management network.

The keyword default may also be used for the source, which allows a request from any source.

Warning

The best practice is to limit access by source so that only specific clients may access SNMP information. Avoid using default if at all possible.

security-name <security-name>:

The VACM security name to which this community should be mapped. This name is then used in groups.

This command may be repeated multiple times. Thus, multiple sources can set be for the same community. It can also be used to setup more complex policies such as different sources for the same community being mapped to different security names, or mapping multiple communities/sources to the same security name.

SNMP Groups¶

A group defines a VACM group, which is a collection of security names that have the same level of access.

tnsr(config)# [no] snmp group group-name <group-name>
                              security-name <security-name>
                              security-model (any|v1|v2c)

The following parameters are available:

group-name <group-name>:: The name of this group, which is used by access rules.
security-name <security-name>:: The security name to add as a member of this group.

Note

In SNMPv1 and SNMPv2, the security name is mapped from a community entry (SNMP Communities). In future versions with SNMPv3, this may also be a SNMPv3 security name (e.g. USM username, TSM identity, etc).
security-model (any|v1|v2c):: The source of this security name, based on how its connection was authorized.

This command may be repeated to add multiple members to the same group.

SNMP Views¶

A view defines a subset of the entire SNMP object identifier (OID) tree. Multiple views with the same name may be defined to build a collection of OIDs to which groups may be granted access.

tnsr(config)# [no] snmp view view-name <view-name>
                             view-type (included|excluded)
                             oid <oid>

The following parameters are available:

view-name <view-name>:

The name of this view. Used in access rules to grant read and write access to portions of the OID tree.

view-type (included|excluded):

Sets the type of view being defined.

included:: When set, objects under oid will be included in the view.
excluded:: When set, objects under oid will be excluded from the view.

oid <oid>:

The base oid under which this view either includes or excludes objects. This may be specified numerically or using names known to the SNMP daemon from MIB files.

For example, the root OID .1 may also be given by its name .iso. Refer to MIB files for details.

This command may be repeated to define complex views which may include and exclude portions of the same OID hierarchy.

SNMP Access Rules¶

An access rule defines which views may be accessed by a given group. This ties together the other VACM entries, granting access to clients.

tnsr(config)# [no] snmp access group-name <group-name>
                               prefix (exact|prefix)
                               model (any|v1|v2c)
                               level (noauth|auth|priv)
                               read <read-view>
                               write <write-view>

The following parameters are available:

group-name <group-name>:: The name of the group being granted access, as defined by VACM group entries (SNMP Groups).
prefix (exact|prefix):: Used by SNMPv3 to control how a context on the rule is applied to the context of the incoming connection. Since SNMPv3 is not yet supported, this must be set to exact.
model (any|v1|v2c):: The security model of the client connection, based on how its connection was authorized.
level (auth|noauth|priv):: The minimum security level at which this access rule will be allowed. Since SNMPv3 and transport security are not yet supported, this must be set to noauth.
read (<read-view>|none):: The name of the view (SNMP Views) to which matching clients will have read access. Use none to deny read access.
write (<write-view>|none):: The name of the view (SNMP Views) to which matching clients will have write access. Use none to deny write access.