SNMP Access
SNMP Access is a standard configuration interface for adding, editing, and removing SNMP Discovery access profiles. Each profile contains SNMP information used to access SNMP on devices. The Device SNMP Discovery scheduled job attempts to assign one of these profiles to each device. Once an SNMP access profile has been assigned to a device it can be used by other SNMP-based components.
Unified Assurance provides a "Default Public" version 2 SNMP Access profile by default, which uses the "public" community string. If your SNMP-enabled devices also use the public community string and SNMPv2, then the "Default Public" profile can be used for SNMP Discovery. If your devices use a different SNMP version and/or different community strings, then a new SNMP Access profile must be created with the relevant information.
SNMP access profiles can be associated with a tenant. Users whose user group or subgroups are associated with specific tenants can only view, create, update, and delete SNMP access profiles for those tenants. Users with all-tenant access can view and manage profiles for all tenants, including the Default tenant.
Refer to the Standard Configuration Interface guide for details on interacting with the grid and form. Some additional functionality is explained in the "Grid Details" section.
This user interface calls REST methods from api/discovery/sNMP.
To open this interface, from the main navigation menu, select Configuration, then Device Discovery, and then SNMP Access.
Grid Details
After being created, a single SNMP profile or group of SNMP profiles can be selected, then use the click-and-drag functionality to change the order profiles are used during discovery.
The grid includes a Tenant column. Profiles with no tenant association display N/A. Profiles associated with the default tenant display Default. The Tenant column can be sorted and filtered.
Form Fields
-
SNMP Version - SNMP version used with the profile.
Caution:
SNMP v1 and v2c use plain text community strings and are not recommended by Oracle.
-
Profile Name - The name of the access profile.
-
Priority Order - The order in which the profile is used. (A lower number has a higher priority, so it will be used first.)
-
SNMP UDP Port - SNMP Port used for the connection.
-
MTU - MTU size for the connection.
-
Device Zone - Device Zone the profile will be used against. Can also be set to [All] if an access profile is to be used in multiple zones.
-
Tenant - Tenant associated with the profile. The list only includes tenants available to the current user. Users with all-tenant access can select Default.
-
Community String - If SNMP Version is set to v1 or v2c, the SNMP community string to be used for access.
-
Security Level - If SNMP Version is set to v3, the security level used for the profile:
-
noAuthNoPriv = Communication without authentication and privacy.
-
authNoPriv = Communication with authentication and without privacy.
-
authPriv = Communication with authentication and privacy.
-
-
Username - If SNMP Version is set to v3, the user name for authentication.
-
Authentication Protocol - If Security Level is set to authPriv or authNoPriv, the hashing algorithm to be used in the authentication exchange.
Caution:
The following authentication protocols have weak hashing and are not recommended by Oracle:
- MD5
-
Authentication Password - If Security Level is set to authPriv or authNoPriv, the password to be used in authentication.
-
Privacy Protocol - If Security Level is set to authPriv, the protocol used for session encryption.
Caution:
The following privacy protocols have weak encryption and are not recommended by Oracle:
-
DES
-
3DES
-
-
Authentication Password - If Security Level is set to authPriv or authNoPriv, the password to be used in authentication.
-
Privacy Password - If Security Level is set to authPriv, the password to be used in privilege authentication.
Note:
This is in addition to Authentication Password, not instead of.
-
Engine ID - A hexadecimal series of octets ranging in length from 5 to 31 octets. It must not contain any delimiters. It must be the authoritative engine ID. For SNMP v3 informs, use a remote engine ID.
Best Practices
-
The public community string is the default read-only community on many devices. This can be a security risk and best practice is to change the default community to a local, protected value. Some customers leave the default public community in their access profiles to be used as a warning. If they find that any devices have been associated with the public profile, it is a nice early-warning sign that an improperly configured device has been added to their network.
-
It is possible for the same community string to be used by both v1 and v2c devices. It is preferable for different strings to be used, but if the same string must be used, assign the v1 profile a higher Priority Order. This will ensure that v2c devices will use the v2c profile and the v1 devices will use the v1 profile. Using the correct version will reduce problems in other applications such as interface discovery, metrics collection, etc.
-
The SNMP v1 and v2c policies use plain text community strings and are not recommended by Oracle.
-
The SNMP v3 privacy policies 3DES, AES (192), and AES (256) are draft policies and may not be supported by your vendor.
-
The following authentication protocols have weak hashing and are not recommended by Oracle:
- MD5
-
The following privacy protocols have weak encryption and are not recommended by Oracle:
-
DES
-
3DES
-