Users Guide

SNMP groups and users
A member of an SNMP group that accesses the local SNMP agent is known as an SNMP user. An SNMP user on a remote device is
identied by an IP address and UDP port from which the user accesses the local agent.
In OS10, users are assigned SNMP access privielges according to the group they belong to. You congure each group for access to SNMP
MIB tree views.
SNMP views
In OS10, you congure views for each security model and level in an SNMP user group. Each type of view species the object ID (OID) in
the MIB tree hierarchy at which the view starts. You can also specify whether the rest of the MIB tree structure is included or excluded
from the view.
• A read view provides read-only access to the specied OID tree.
• A write view provides read-write access to the specied OID tree.
• A notify view allows SNMP notications (traps and informs) from the specied OID tree to be sent to other members of the group.
Congure SNMP
To set up communication with SNMP agents in your network:
• Congure the read-only, read-write, and notify access for SNMP groups.
• Congure groups with SNMP views for specied SNMP versions (security models).
• Assign users to groups and congure SNMPv3-specic authentication and encryption settings, and optionally, localized security keys
and ACL-based access.
Conguring SNMP consists of these tasks in any order:
• Congure SNMP engine ID
• Congure SNMP views
• Congure SNMP groups
• Congure SNMP users
Congure SNMP engine ID
The engine ID identies the SNMP local agent on a switch. The engine ID is an octet colon-separated number; for example,
80:00:02:b8:04:61:62:63 .
The local engine ID is used to create a localized authentication and/or privacy key for greater security in SNMPv3 messages. You generate
a localized authentication and/or privacy key when you congure an SNMPv3 user.
Congure a remote device and its engine ID to allow a remote user to query the local SNMP agent. The remote engine ID is included in the
query and used to generate the authentication and privacy password keys to access the local agent. If you do not congure the remote
engine ID, remote users' attempts to access the local agent fail.
NOTE
: Create a remote engine ID with the snmp-server engineID command before you congure a remote user with the
snmp-server user command. If you change the congured engine ID for a remote device, you must recongure the
authentication and privacy passwords for all remote users associated with the remote engine ID.
snmp-server engineID [local engineID] [remote ip-address {[udp-port port-number] remote-
engineID}]
118
System management