The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
The SNMP Support over VPNs--Context-Based Access Control feature provides the infrastructure for multiple Simple Network Management Protocol (SNMP) context support in Cisco IOS software and VPN-aware MIB infrastructure using the multiple SNMP context support infrastructure.
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the Feature Information Table at the end of this document.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Cisco IOS software supports the following versions of SNMP:
For more information about SNMP Versions, see the “ Configuring SNMP Support ” module in the Cisco IOS Network Management Configuration Guide .
SNMPv1 and SNMPv2 are not as secure as SNMPv3. SNMP version 1 and 2 use plain text communities and do not perform the authentication or security checks that SNMP version 3 performs. To configure the SNMP Support over VPNs--Context-Based Access Control feature when using SNMP version 1 or SNMP version 2, you need to associate a community name with a VPN. This association causes SNMP to process requests coming in for a particular community string only if it comes in from the configured VRF. If the community string contained in the incoming packet does not have an associated VRF, it is processed only if it came in through a non-VRF interface. This process prevents users outside the VPN from snooping a clear text community string to query the VPN’s data. These methods of source address validation are not as secure as using SNMPv3.
If you are using SNMPv3, the security name should always be associated with authentication or privileged passwords. Source address validation is not performed on SNMPv3 users. To ensure that a VPN’s user has access only to context associated to the VPN and cannot see the MIB data of other VPNs, you must configure a minimum security level of AuthNoPriv.
On a provider edge (PE) router, a community can be associated with a VRF to provide source address validation. However, on a customer edge (CE) router, if source address validation is to be provided, you must associate a source address with the community list by using an access control list.
If you are using SNMPv3, the security name or security password of the users of a VPN should be unknown to users of other VPNs. Cisco recommends not to use SNMPv3 nonauthorized users if you need security of management information.
The SNMP Notification Support over VPNs feature allows the sending and receiving of SNMP notifications (traps and informs) using VPN routing and forwarding (VRF) instance tables. In particular, this feature adds support to Cisco IOS software for the sending and receiving of SNMP notifications (traps and informs) specific to individual VPNs.
SNMP is an application-layer protocol that provides a message format for communication between SNMP managers and agents.
A VPN is a network that provides high-connectivity transfers on a shared system with the same usage guidelines as a private network. A VPN can be built on the Internet over IP, Frame Relay, or ATM networks.
A VRF stores per-VPN routing data. It defines the VPN membership of a customer site attached to the network access server (NAS). A VRF consists of an IP routing table, a derived Cisco Express Forwarding (formerly known as CEF) table, and guidelines and routing protocol parameters that control the information that is included in the routing table.
The SNMP Support for VPNs--Context-Based Access Control feature provides configuration commands that allow users to associate SNMP agents and managers with specific VRFs. The associated VRF is used for the sending of SNMP notifications (traps and informs) and responses between agents and managers. If a VRF is not specified, the default routing table for the VPN is used.
The SNMP Support for VPNs--Context-Based Access Control feature extends the capabilities of the SNMP Notification Support for VPNs feature and enables SNMP to differentiate between incoming packets from different VPNs.
When the SNMP Support for VPNs--Context-Based Access Control feature is configured, SNMP accepts requests on any configured VRF and returns responses to the same VRF. A trap host also can be associated with a specific VRF. The configured VRF is then used for sending out traps; otherwise, the default routing table is used. You also can associate a remote user with a specific VRF. You also can configure the VRFs from which SNMP should accept requests. Any requests coming from VRFs that are not specified are dropped.
IP access lists can be configured and associated with SNMP community strings. This feature enables you to configure an association between VRF instances with SNMP community strings. When a VRF instance is associated with an SNMP community string, SNMP processes the requests coming in for a particular community string only if the requests are received from the configured VRF. If the community string contained in the incoming packet does not have a VRF associated with it, the community string will be processed only if it came in through a non-VRF interface.
You also can enable or disable authentication traps for SNMP packets dropped due to VRF mismatches. By default if SNMP authentication traps are enabled, VRF authentication traps are also enabled.
A route distinguisher (RD) creates routing and forwarding tables and specifies the default route distinguisher for a VPN. The RD is added to the beginning of the customer’s IPv4 prefixes to change them into globally unique VPN-IPv4 prefixes.
The RD is either an autonomous system number (ASN)-relative RD, in which case it comprises an autonomous system number and an arbitrary number, or it is an IP-address-relative RD, in which case it comprises an IP address and an arbitrary number.
You can enter an RD in either of these formats:
SNMP contexts provide VPN users with a secure way of accessing MIB data. When a VPN is associated with a context, that VPN’s specific MIB data exists in that context. Associating a VPN with a context enables service providers to manage networks with multiple VPNs. Creating and associating a context with a VPN enables a provider to prevent the users of one VPN from accessing information about other VPN userss on the same networking device.
VPN-aware SNMP requires an agreement between SNMP manager and agent entities operating in a VPN environment on a mapping between the SNMP security name and the VPN ID. This mapping is created by using multiple contexts for the SNMP data of different VPNs through the configuration of the SNMP-VACM-MIB. The SNMP-VACM-MIB is configured with views so that a user on a VPN with a security name is allowed access to the restricted object space associated with a user’s access type in the context associated with the user of that VPN.
SNMP request messages undergo three phases of security and access control before a response message is sent back with the object values in the context of a VPN:
Perform this task to configure an SNMP context and to associate the SNMP context with a VPN.
Perform this task to configure SNMP support and associate it with an SNMP context.
Command or Action | Purpose | |
---|---|---|
|
Example: Router> enable |
Enables privileged EXEC mode.
|
|
Example: Router# configure terminal |
Enters global configuration mode. |
|
Example: Router(config)# snmp-server user customer1 group1 v1 |
Configures a new user to an SNMP group. |
|
Example: Router(config)# snmp-server group group1 v1 context context1 read view1 write view1 notify view1 |
Configures a new SNMP group or a table that maps SNMP users to SNMP views.
|
|
Example: Router(config)# snmp-server view view1 ipForward included |
Creates or updates a view entry. |
|
Example: Router(config)# snmp-server enable traps |
Enables all SNMP notifications (traps or informs) available on your system. |
|
Example: Router(config)# snmp-server community public view view1 rw |
Sets up the community access string to permit access to the SNMP. |
|
Example: Router(config)# snmp-server host 10.0.0.1 vrf vrf1 public udp-port 7002 |
Specifies the recipient of an SNMP notification operation. |
|
Example: Router(config)# snmp mib community-map community1 context context1 target-list commAVpn |
Associates an SNMP community with an SNMP context, Engine ID, or security name. |
|
Example: Router(config)# snmp mib target list commAVpn vrf vrf1 |
Creates a list of target VRFs and hosts to associate with an SNMP community. |
|
Example: Router(config)# no snmp-server trap authentication vrf |
(Optional) Disables all SNMP authentication notifications (traps and informs) generated for packets received on VRF interfaces.
|
The following configuration example shows how to configure the SNMP Support over VPNs--Context-Based Access Control feature for SNMPv3:
![]() Note |
In Cisco IOS Release 15.0(1)M and later releases, the context command is replaced by the snmp context command. See the Network Management Command Reference for more information. |
snmp-server context A snmp-server context B ip vrf CustomerA rd 100:110 context A route-target export 100:1000 route-target import 100:1000 ! ip vrf CustomerB rd 100:120 context B route-target export 100:2000 route-target import 100:2000 ! interface Ethernet3/1 description Belongs to VPN A ip vrf forwarding CustomerA ip address 192.168.2.1 255.255.255.0 interface Ethernet3/2 description Belongs to VPN B ip vrf forwarding CustomerB ip address 192.168.2.2 255.255.255.0 snmp-server user CustomerAv3authusr CustomerAv3grpauth v3 auth md5 passwdA snmp-server user CustomerBv3authusr CustomerBv3grpauth v3 auth md5 passwdB snmp-server group CustomerAv3grpauth v3 auth context A read CustomerAv3view write CustomerAv3view notify CustomerAv3view snmp-server group CustomerBv3grpauth v3 auth context B read CustomerBv3view write CustomerBv3view notify CustomerBv3view snmp-server view view1 internet included snmp-server view view1 internet.6.3.16 included snmp-server view view1 internet.6.3.17 included snmp-server view view1 internet.6.3.18 included snmp-server view CustomerAv3view ipForward included snmp-server view CustomerAv3view ciscoPingMIB included snmp-server view CustomerBv3view ipForward included snmp-server view CustomerBv3view ciscoPingMIB included snmp-server community public view view1 rw snmp-server enable traps snmp-server host 192.168.2.3 vrf CustomerA version 3 auth CustomerAv3authusr udp-port 7002 snmp-server host 192.168.2.4 vrf CustomerB version 3 auth CustomerBv3authusr udp-port 7002
The following configuration example shows how to configure the SNMP Support over VPNs--Context-Based Access Control feature for SNMPv1 or SNMPv2:
![]() Note |
In Cisco IOS Release 15.0(1)M and later releases, the context command is replaced by the snmp context command. See the Network Management Command Reference for more information. |
snmp-server context A snmp-server context B ip vrf Customer_A rd 100:110 context A route-target export 100:1000 route-target import 100:1000 ! ip vrf Customer_B rd 100:120 context B route-target export 100:2000 route-target import 100:2000 ! interface Ethernet3/1 description Belongs to VPN A ip vrf forwarding CustomerA ip address 192.168.2.1 255.255.255.0 interface Ethernet3/2 description Belongs to VPN B ip vrf forwarding CustomerB ip address 192.168.2.2 255.255.255.0 snmp-server user commA grp1A v1 snmp-server user commA grp2A v2c snmp-server user commB grp1B v1 snmp-server user commB grp2B v2c snmp-server group grp1A v1 context A read viewA write viewA notify viewA snmp-server group grp1B v1 context B read viewB write viewB notify viewB snmp-server view viewA ipForward included snmp-server view viewA ciscoPingMIB included snmp-server view viewB ipForward included snmp-server view viewB ciscoPingMIB included snmp-server enable traps snmp-server host 192.168.2.3 vrf CustomerA commA udp-port 7002 snmp-server host 192.168.2.4 vrf CustomerB commB udp-port 7002 snmp mib community-map commA context A target-list commAvpn ! Configures source address validation snmp mib community-map commB context B target-list commBvpn ! Configures source address validation snmp mib target list commAvpn vrf CustomerA ! Configures a list of VRFs or from which community commA is valid snmp mib target list commBvpn vrf CustomerB ! Configures a list of VRFs or from which community commB is valid
Related Topic |
Document Title |
---|---|
Cisco IOS commands |
|
Cisco IOS Network Management commands |
Cisco IOS Network Management Command Reference |
SNMP configuration |
“ Configuring SNMP Support ” chapter in the Cisco IOS Network Management Configuration Guide |
SNMP Support for VPNs |
SNMP Notification Support for VPNs |
Standard |
Title |
---|---|
None |
-- |
MIB |
MIBs Link |
---|---|
To locate and download MIBs for selected platforms, Cisco software releases, and feature sets, use Cisco MIB Locator found at the following URL: |
RFC |
Title |
---|---|
RFC 1441 |
Introduction to version 2 of the Internet-standard Network Management Framework |
RFC 1442 |
Structure of Management Information for version 2 of the Simple Network Management Protocol (SNMPv2) |
RFC 1443 |
Textual Conventions for version 2 of the Simple Network Management Protocol (SNMPv2) |
RFC 1444 |
Conformance Statements for version 2 of the Simple Network Management Protocol (SNMPv2) |
RFC 1445 |
Administrative Model for version 2 of the Simple Network Management Protocol (SNMPv2) |
RFC 1446 |
Security Protocols for version 2 of the Simple Network Management Protocol (SNMPv2) |
RFC 1447 |
Party MIB for version 2 of the Simple Network Management Protocol (SNMPv2) |
RFC 1448 |
Protocol Operations for version 2 of the Simple Network Management Protocol (SNMPv2) |
RFC 1449 |
Transport Mappings for version 2 of the Simple Network Management Protocol (SNMPv2) |
RFC 1450 |
Management Information Base for version 2 of the Simple Network Management Protocol (SNMPv2) |
RFC 2571 |
An Architecture for Describing SNMP Management Frameworks |
RFC 2576 |
Coexistence between Version 1, Version 2, and Version 3 of the Internet-standard Network Management Framework |
Description |
Link |
---|---|
The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password. |
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Table 1 | Feature Information for SNMP Support over VPNs--Context-Based Access Control |
Feature Name |
Releases |
Feature Information |
---|---|---|
SNMP Support over VPNs--Context-Based Access Control |
12.0(23)S 12.2(25)S 12.2(31)SB2 12.2(33)SRA 12.2(33)SXH 12.3(2)T 15.0(1)M 15.0(1)S Cisco IOS XE Release 3.1.0SG |
The SNMP Support over VPNs--Context-Based Access Control feature provides the infrastructure for multiple SNMP context support in Cisco IOS software and VPN-aware MIB infrastructure using the multiple SNMP context support infrastructure. |
MPLS VPN --Multiprotocol Label Switching Virtual Private Network
NMS --Network Management System. System responsible for managing at least part of a network. An NMS is generally a reasonably powerful and well-equipped computer, such as an engineering workstation. NMSs communicate with agents to help keep track of network statistics and resources.
SNMP --Simple Network Management Protocol. Network management protocol used almost exclusively in TCP/IP networks. SNMP provides a means to monitor and control network devices and to manage configurations, statistics collection, performance, and security.
SNMP communities --Authentication scheme that enables an intelligent network device to validate SNMP requests.
SNMPv2c --Version 2c of the Simple Network Management Protocol. SNMPv2c supports centralized and distributed network management strategies and includes improvements in the Structure of Management Information (SMI), protocol operations, management architecture, and security.
SNMPv3 --Version 3 of the Simple Network Management Protocol. Interoperable standards-based protocol for network management. SNMPv3 provides secure access to devices by a combination of authenticating and encrypting packets over the network.
UDP --User Datagram Protocol. Connectionless transport layer protocol in the TCP/IP protocol stack. UDP is a simple protocol that exchanges datagrams without acknowledgments or guaranteed delivery, requiring that error processing and retransmission be handled by other protocols. UDP is defined in RFC 768.
VRF --A VPN routing and forwarding instance. A VRF consists of an IP routing table, a derived forwarding table, a set of interfaces that use the forwarding table, and a set of rules and routing protocols that determine what goes into the forwarding table. In general, a VRF includes the routing information that defines a customer VPN site that is attached to a PE router.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.