User-Based Security Model - Cisco Nexus 5000 Series Configuration Manual

SNMPv3
Model
v3

User-Based Security Model

SNMPv3 User-Based Security Model (USM) refers to SNMP message-level security and offers the following
services:
• Message integrity—Ensures that messages have not been altered or destroyed in an unauthorized manner
and that data sequences have not been altered to an extent greater than can occur non-maliciously.
• Message origin authentication—Ensures that the claimed identity of the user on whose behalf received
data was originated is confirmed.
• Message confidentiality—Ensures that information is not made available or disclosed to unauthorized
individuals, entities, or processes.
SNMPv3 authorizes management operations only by configured users and encrypts SNMP messages.
Cisco NX-OS uses two authentication protocols for SNMPv3:
• HMAC-MD5-96 authentication protocol
• HMAC-SHA-96 authentication protocol
Cisco NX-OS uses Advanced Encryption Standard (AES) as one of the privacy protocols for SNMPv3 message
encryption and conforms with RFC 3826.
The priv option offers a choice of DES or 128-bit AES encryption for SNMP security encryption. The priv
option along with the aes-128 token indicates that this privacy password is for generating a 128-bit AES
key.The AES priv password can have a minimum of eight characters. If the passphrases are specified in clear
text, you can specify a maximum of 64 characters. If you use the localized key, you can specify a maximum
of 130 characters.
For an SNMPv3 operation using the external AAA server, you must use AES for the privacy protocol in
Note
user configuration on the external AAA server.
Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.2(1)N1(1)
146
Level Authentication
authPriv HMAC-MD5 or
HMAC-SHA
Configuring SNMP
Encryption What Happens
DES Provides
authentication based
on the HMAC-MD5
or HMAC-SHA
algorithms. Provides
Data Encryption
Standard (DES)
56-bit encryption in
addition to
authentication based
on the Cipher Block
Chaning (CBC)
DES (DES-56)
standard.