Cisco nexus 5000 series Cli Configuration Manual page 368

Information About SNMP
S e n d f e e d b a c k t o n x 5 0 0 0 - d o c f e e d b a c k @ c i s c o . c o m
Cisco Nexus 5000 Series uses two authentication protocols for SNMPv3:
•
•
Cisco Nexus 5000 Series uses Advanced Encryption Standard (AES) as one of the privacy protocols for
SNMPv3 message encryption and conforms with RFC 3826.
The priv option offers a choice of DES or 128-bit AES encryption for SNMP security encryption. The
priv option along with the aes-128 token indicates that this privacy password is for generating a 128-bit
AES key.The AES priv password can have a minimum of eight characters. If the passphrases are
specified in clear text, you can specify a maximum of 64 characters. If you use the localized key, you
can specify a maximum of 130 characters.
For an SNMPv3 operation using the external AAA server, you must use AES for the privacy protocol in
Note
user configuration on the external AAA server.
CLI and SNMP User Synchronization
SNMPv3 user management can be centralized at the Access Authentication and Accounting (AAA)
server level. This centralized user management allows the SNMP agent in Cisco Nexus 5000 Series to
leverage the user authentication service of the AAA server. Once user authentication is verified, the
SNMP PDUs are processed further. Additionally, the AAA server is also used to store user group names.
SNMP uses the group names to apply the access/role policy that is locally available in the switch.
Any configuration changes made to the user group, role, or password results in database synchronization
for both SNMP and AAA.
Cisco Nexus 5000 Series synchronizes user configuration in the following ways:
•
•
•
•
Note
Group-Based SNMP Access
Because group is a standard SNMP term used industry-wide, we refer to role(s) as group(s) in this SNMP
Note
section.
SNMP access rights are organized by groups. Each group in SNMP is similar to a role through the CLI.
Each group is defined with three accesses: read access, write access, and notification access. Each access
can be enabled or disabled within each group.
Cisco Nexus 5000 Series Switch CLI Software Configuration Guide
1-4
HMAC-MD5-96 authentication protocol
HMAC-SHA-96 authentication protocol
The auth passphrase specified in the snmp-server user command becomes the password for the
CLI user.
The password specified in the username command becomes as the auth and priv passphrases for
the SNMP user.
Deleting a user using either SNMP or the CLI results in the user being deleted for both SNMP and
the CLI.
User-role mapping changes are synchronized in SNMP and the CLI.
When you configure passphrase/password in localized key/encrypted format, Cisco Nexus 5000
Series does not synchronize the password.
Chapter 1 Configuring SNMP
OL-16597-01