Cisco nexus 5000 series Cli Configuration Manual page 367

Chapter 1 Configuring SNMP
S e n d f e e d b a c k t o n x 5 0 0 0 - d o c f e e d b a c k @ c i s c o . c o m
Security Models and Levels for SNMPv1, v2, v3
The security level determines if an SNMP message needs to be protected from disclosure and if the
message needs to be authenticated. The various security levels that exist within a security model are as
follows:
•
•
•
Three security models are available: SNMPv1, SNMPv2c, and SNMPv3. The security model combined
with the security level determine the security mechanism applied when the SNMP message is processed.
Table 1-1
User-Based Security Model
Table 1-1
Model
v1
v2c
v3
v3
v3
SNMPv3 User-Based Security Model (USM) refers to SNMP message-level security and offers the
following services:
•
•
•
SNMPv3 authorizes management operations only by configured users and encrypts SNMP messages.
OL-16597-01
noAuthNoPriv—Security level that does not provide authentication or encryption.
authNoPriv—Security level that provides authentication but does not provide encryption.
authPriv—Security level that provides both authentication and encryption.
identifies what the combinations of security models and levels mean.
SNMP Security Models and Levels
Level
noAuthNoPriv
noAuthNoPriv
noAuthNoPriv
authNoPriv
authPriv
Message integrity—Ensures that messages have not been altered or destroyed in an unauthorized
manner and that data sequences have not been altered to an extent greater than can occur
non-maliciously.
Message origin authentication—Ensures that the claimed identity of the user on whose behalf
received data was originated is confirmed.
Message confidentiality—Ensures that information is not made available or disclosed to
unauthorized individuals, entities, or processes.
Authentication Encryption What Happens
Community string No
Community string No
Username No
HMAC-MD5 or No
HMAC-SHA
HMAC-MD5 or DES
HMAC-SHA
Cisco Nexus 5000 Series Switch CLI Software Configuration Guide
Information About SNMP
Uses a community string match for
authentication.
Uses a community string match for
authentication.
Uses a username match for
authentication.
Provides authentication based on the
Hash-Based Message Authentication
Code (HMAC) Message Digest 5
(MD5) algorithm or the HMAC
Secure Hash Algorithm (SHA).
Provides authentication based on the
HMAC-MD5 or HMAC-SHA
algorithms. Provides Data Encryption
Standard (DES) 56-bit encryption in
addition to authentication based on
the Cipher Block Chaining (CBC)
DES (DES-56) standard.
1-3