Snmpv3 Security - Extreme Networks ExtremeWare 7.2e Installation And User Manual

Managing the Switch

SNMPv3 Security

In SNMPv3 the User-Based Security Model (USM) for SNMP was introduced. USM deals with security
related aspects like authentication, encryption of SNMP messages and defining users and their various
access security levels. This standard also encompass protection against message delay and message
replay.
USM Timeliness Mechanisms
There is one SNMPv3 engine on an Extreme switch, identified by its snmpEngineID. The first four octets
are fixed to 80:00:07:7C, which represents the Extreme Networks Vendor ID. By default, the additional
octets for the snmpEngineID are generated from the device MAC address. Every SNMPv3 engine
necessarily maintains two objects: SNMPEngineBoots, which is the number of reboots the agent has
experienced and SNMPEngineTime, which is the engine local time since reboot. It has a local copy of
these objects and the latestReceivedEngineTime for every authoritative engine it wants to communicate
with. Comparing these objects with the values received in messages and then applying certain rules to
decide upon the message validity accomplish protection against message delay or message replay.
In a chassis, the will be generated using the MAC address of the MSM with which the
snmpEngineID
switch boots first. For MSM hitless failover, the same will be propagated to both of the
snmpEngineID
MSMs.
The snmpEngineID can be configured from the command line, but once the is changed,
snmpEngineID
default users will be reverted back to their original passwords/keys, while non-default users will be
reset to the security level of no authorization, no privacy. Use the following command to set the
snmpEngineID:
configure snmpv3 engine-id <hex octet>
SNMPEngineBoots can also be configured from the command line. SNMPEngineBoots can be set to any
desired value but will latch on its maximum, 2147483647. Use the following command to set the
SNMPEngineBoots:
configure snmpv3 engine-boots <(1-2147483647)>
Users, Groups, and Security
SNMPv3 controls access and security using the concepts of users, groups, security models, and security
levels.
Users. Users are created by specifying a user name. Depending on whether the user will be using
authentication and/or privacy, you would also specify an authentication protocol (MD5 or SHA) with
password or key, and/or privacy (DES) password or key. To create a user, use the following command:
configure snmpv3 add user {hex} <user name> {authentication [md5 | sha] [hex <hex
octet> | <password>]} {privacy [hex <hex octet> | <password>]} {volatile}
There are a number of default, permanent users initially available.The default user names are: admin,
initial, initialmd5, initialsha, initialmd5Priv, initialshaPriv. The default password for admin is password. For
the other default users, the default password is the user name.
To display information about a user, or all users, use the following command:
show snmpv3 user {{hex} <user name>}
58 ExtremeWare 7.2e Installation and User Guide