![]() |
|||
![]() |
![]() ![]() |
![]() |
![]() ![]() |
![]() |
![]() ![]() |
![]() |
| |||||||||||||||||||||||||||
Format of the Trap GroupThe trap group specifies the hosts to which the agent will send traps if the InetAddressAcl mechanism is used. This group contains one or more trap community definitions.
Each community definition defines the association between a set of hosts and the SNMP community string in the traps to be sent to them. Each trap definition has the following format:
The trapCommunityName item specifies a single SNMP community string. It will be included in the traps sent to the hosts specified in the hosts item. SNMPv3 does not use the community string, so use IP addresses or the context name instead. The trapHostList item specifies a comma-separated list of hosts. Each host must be identified by its name or complete IP address. When the SNMP protocol adaptor is instructed to send a trap using the InetAddressAcl mechanism, it will send a trap to every host listed in the trap community definitions. If a host is present in more than one list, it will receive more than one trap, each one identified by its corresponding trap community. SNMPv3 User-Based Access ControlThe user-based access control implemented by SNMPv3 is based on contexts and user names. The users, contexts and associated security information controlling access to the agents in an SNMP session are defined in the nma.uacl file. Example 4-2 Example nma.uacl.template File
In the nma.uacl file, you define the following:
By uncommenting the acl block in Example 4-2, you would limit access to MIBs in the TEST-CONTEXT context only, and grant read-write access to the user defaultUser. The security level in the file must also match that of user defaultUser. Therefore, any non-authenticated requests, any request with different security levels, or any requests from a user other than defaultUser, would be rejected. Configuring SNMPv3 SecurityUnder SNMPv1 and SNMPv2, agents act as information servers, and IP-based access control is used to protect this information from unauthorized access. The SNMPv3 protocol provides much more sophisticated security mechanisms, implementing a user-based security model (USM). This model allows both authentication and encryption of the requests sent between agents and their managers, as well as user-based access control. Note - The default NMA configuration is an example of an SNMPv3 configuration. Modify the security parameters to fit your security requirements. You can add and remove users in the nma.security file as specified in Managing Users in Security Files. Engine IDSecure SNMPv3 communication requires that the SNMP engine ID, which is generated by the NMA for each node, is used to communicate with the NMA. The SNMP engine ID is unique for the SNMP domain. It is a hexadecimal string calculated from a concatenation of the following properties of the NMA on each node:
The engine ID is stored in the nma.security file of each NMA. The engine ID may be substituted for another engine ID. Context NameThe NMA MIB is not registered under the scope of any context. Managing Users in Security FilesEvery user that has access to an agent is represented by a userEntry line in each of the agent's security files. You configure the userEntry as follows, with the parameters separated commas: userEntry=engine ID,user name,security name,authentication algorithm,authentication key, privacy algorithm,privacy key,storage type,template The only mandatory parameters are the engine ID and the user name. All the other parameters are optional. The possible values for the parameters are as follows:
| |||||||||||||||||||||||||||
| |||||||||||||||||||||||||||
![]() |