Snmpv3 Mib Access Control - Extreme Networks ExtremeWare XOS Guide Manual

Using the Simple Network Management Protocol

SNMPv3 MIB Access Control

SNMPv3 provides a fine-grained mechanism for defining which parts of the MIB can be accessed. This
is referred to as the View-Based Access Control Model (VACM).
MIB views represent the basic building blocks of VACM. They are used to define a subset of the
information in the MIB. Access to read, to write, and to generate notifications is based on the
relationship between a MIB view and an access group. The users of the access group can then read,
write, or receive notifications from the part of the MIB defined in the MIB view as configured in the
access group.
A view name, a MIB subtree/mask, and an inclusion or exclusion define every MIB view. For example,
there is a System group defined under the MIB-2 tree. The Object Identifier (OID) for MIB-2 is 1.3.6.1.2,
and the System group is defined as MIB-2.1.1, or directly as 1.3.6.1.2.1.1.
To define a MIB view which includes only the System group, use the following subtree/mask
combination:
1.3.6.1.2.1.1/1.1.1.1.1.1.1.0
The mask can also be expressed in hex notation (this is used for the ExtremeWare XOS CLI):
1.3.6.1.2.1.1/fe
To define a view that includes the entire MIB-2, use the following subtree/mask:
1.3.6.1.2.1.1/1.1.1.1.1.0.0.0
which, in the CLI, is:
1.3.6.1.2.1.1/f8
When you create the MIB view, you can choose to include the MIB subtree/mask or to exclude the MIB
subtree/mask. To create a MIB view, use the following command:
configure snmpv3 add mib-view [[hex <hex_view_name>] | <view_name>] subtree
<object_identifier> {/<subtree_mask>} {type [included | excluded]} {volatile}
After the view has been created, you can repeatedly use the
configure snmpv3 add mib-view
command to include and/or exclude MIB subtree/mask combinations to precisely define the items you
want to control access to.
In addition to the user-created MIB views, there are three default views. These default views are of
storage type permanent and cannot be deleted, but they can be modified. The default views are:
defaultUserView, defaultAdminView, and defaultNotifyView. To show MIB views, use the following
command:
show snmpv3 mib-view {[[hex <hex_view_name>] | <view_name>] {subtree
<object_identifier>}}
To delete a MIB view, use the following command:
configure snmpv3 delete mib-view [all-non-defaults | {[[hex <hex_view_name>] |
<view_name>] {subtree <object_identifier>}}]
MIB views that are used by security groups cannot be deleted.
63
ExtremeWare XOS 11.1 Concepts Guide