Configure SNMPv3

Configuration Conditions

Before configuring SNMPv3, first complete the following task:

• Configure the link-layer protocol, ensuring the normal communication of the link layer
• Configure the IP address of the interface, making the network layer of the neighboring nodes reachable

Create SNMP User Group

During controlling, we can associate some user with one group. The users of one group have the same access authority.

• We can configure one group to associate with the view. There are three kinds of views, that is, read-only view, write view and notify view.
• We can configure the security level of the group, configuring whether to need the authentication and encryption.

Table 8–8 Create the SNMP user group

Create SNMP User

Perform the security management via the user-based security model. The network work station can communicate with the SNMP proxy only after using the valid user. The valid user needs to be configured.

For SNMPv3, we also can specify the security level, authentication algorithm (MD5 or SHA), authentication password, encryption algorithm (DES), and encryption password.

Table 8–9 Configure the user

• ---

  Configure the SNMPv3 user based on the user security model (USM), save the authentication and encryption information of each user. Note that only after configuring the authentication protocol, we can configure the encryption protocol.
• For the remote user (the so-called remote is relative to the local SNMPv3 entity. If the local SNMPv3 entity needs to communicate with other SNMPv3 entity, the other SNMPv3 entity is called remote SNMPv3 entity. This is mentioned in notify and proxy), we also need to specify the IP address and UDP port number of the remote user. When configuring the remote user, we should configure the engineID of the remote SNMP entity of the user first. Besides, each user should correspond with one group so that we can map one security model and security name to one group name via the view-based access control.
• When configuring the auto proxy forwarding and we may not know the IP address of the delegated device, we only need to input 0.0.0.0 at ip-address. Besides, the auto proxy forwarding should be combined with the keepalive mechanism.

  ---

Configure SNMP Notify

SNMPv3 notify configuration contains the following several kinds:

• SNMPv3 notify configuration: Configure the SNMPv3 notify and specify the type of the notify message as inform;
• SNMPv3 notify filter configuration: Notify filter means the filter used to determine whether one notify message should be sent to one destination address.
• SNMPv3 notify address map table configuration: Associate the notify address with one filter table.

Table 8–10 Configure the notify

Configure SNMP Proxy Forwarding

If the network work station cannot directly access the managed SNMP proxy, the intermediate device needs to support the proxy forwarding. Currently, only SNMPv3 supports the proxy forwarding.

Table 8–11 Configure the proxy forwarding