SNMP Support over VPNs—Context-Based Access Control

The SNMP Support over VPNs—Context-Based Access Control feature provides the infrastructure for multiple Simple Network Management Protocol (SNMP) context support in Cisco software and VPN-aware MIB infrastructure using the multiple SNMP context support infrastructure.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.

Restrictions for SNMP Support over VPNs—Context-Based Access Control

  • If you delete an SNMP context using the no snmp-server context command, all SNMP instances in that context are deleted.

  • Not all MIBs are VPN-aware.

Information About SNMP Support over VPNs—Context-Based Access Control

SNMP Versions and Security

Cisco software supports the following versions of SNMP:

  • SNMPv1—Simple Network Management Protocol: a full Internet standard, which is defined in RFC 1157. (RFC 1157 replaces the earlier versions that were published as RFC 1067 and RFC 1098.) Security is based on the community strings.

  • SNMPv2c—The community string-based Administrative Framework for SNMPv2. SNMPv2c (the "c" is for "community") is an experimental IP that is defined in RFC 1901, RFC 1905, and RFC 1906. SNMPv2c is an update of the protocol operations and data types of SNMPv2p (SNMPv2 Classic) and uses the community-based security model of SNMPv1.

For more information about SNMP versions, see the “Configuring SNMP Support” module in the Cisco Network Management Configuration Guide.

SNMPv1 or SNMPv2 Security

Cisco IOS software supports the following versions of SNMP:

  • SNMPv1—Simple Network Management Protocol: a full Internet standard, that is defined in RFC 1157. (RFC 1157 replaces the earlier versions that were published as RFC 1067 and RFC 1098.) Security is based on the community strings.

  • SNMPv2c—The community string-based Administrative Framework for SNMPv2. SNMPv2c (the "c" is for "community") is an experimental IP that is defined in RFC 1901, RFC 1905, and RFC 1906. SNMPv2c is an update of the protocol operations and data types of SNMPv2p (SNMPv2 Classic) and uses the community-based security model of SNMPv1.

SNMPv1 and SNMPv2 are not as secure as SNMPv3. SNMP version 1 and 2 use plain text communities and do not perform the authentication or security checks that SNMP version 3 performs. When using SNMP version 1 or 2, associate a community name with a VPN to configure the SNMP Support over VPNs—Context-Based Access Control feature. This association causes SNMP to process requests coming in for a particular community string only if it comes in from the configured VRF. Community strings without an associated VRF in the incoming packets are processed only if it came through a non-VRF interface. This process prevents users outside the VPN from snooping a clear text community string to query the VPN’s data. These methods of source address validation are not as secure as using SNMPv3.

SNMP Notification Support over VPNs

The SNMP Notification Support over VPNs feature allows the sending and receiving of SNMP notifications (traps and informs) using VPN routing and forwarding (VRF) instance tables. In particular, this feature adds support to Cisco software for the sending and receiving of SNMP notifications (traps and informs) specific to individual VPNs.

SNMP is an application-layer protocol that provides a message format for communication between SNMP managers and agents.

A VPN is a network that provides high-connectivity transfers on a shared system with the same usage guidelines as a private network. A VPN can be built on the Internet over IP, Frame Relay, or ATM networks.

A VRF stores per-VPN routing data. It defines the VPN membership of a customer site that is attached to the network access server (NAS). The VRF consists of an IP routing table and a derived Cisco Express Forwarding (formerly known as CEF) table. VRF also consists of guidelines and routing protocol parameters that control the information that is included in the routing table.

The SNMP Support for VPNs—Context-Based Access Control feature provides configuration commands that allow you to associate SNMP agents and managers with specific VRFs. The associated VRF is used for the sending of SNMP notifications (traps and informs) and responses between agents and managers. If a VRF is not specified, the default routing table for the VPN is used.

VPN-Aware SNMP

The SNMP Support for VPNs—Context-Based Access Control feature extends the capabilities of the SNMP Notification Support for VPNs feature and enables SNMP to differentiate between incoming packets from different VPNs.

When the SNMP Support for VPNs—Context-Based Access Control feature is configured, SNMP accepts requests on any configured VRF and returns responses to the same VRF. A trap host can be associated with a specific VRF. The configured VRF is then used for sending out traps; otherwise, the default routing table is used. You can also associate a remote user with a specific VRF. You can also configure the VRFs from which SNMP accepts requests. Any requests coming from VRFs that are not specified are dropped.

IP access lists can be configured and associated with SNMP community strings. This feature enables you to configure an association between VRF instances with SNMP community strings. When a VRF instance is associated with an SNMP community string, SNMP processes the requests coming in for a particular community string only if the requests are received from the configured VRF. If the community string in the incoming packet does not have a VRF associated with it, the community string must come through a non-VRF interface.

You can also enable or disable authentication traps for SNMP packets dropped due to VRF mismatches. By default if SNMP authentication traps are enabled, VRF authentication traps are also enabled.

VPN Route Distinguishers

A route distinguisher (RD) creates routing and forwarding tables and specifies the default route distinguisher for a VPN. The RD is added to the beginning of your IPv4 prefixes to change them into globally unique VPN-IPv4 prefixes.

The RD is an autonomous system number (ASN)-relative RD, in which case it comprises an autonomous system number and an arbitrary number. Or, the RD is an IP-address-relative RD, in which case it comprises an IP address and an arbitrary number.

You can enter an RD in either of these formats:

  • 16-bit ASN: your 16-bit number: For example, 101:3.

  • 32-bit IP address: your 32-bit number: For example, 192.168.122.15:1.

SNMP Contexts

SNMP contexts provide VPN users with a secure way of accessing MIB data. When a VPN is associated with a context, that VPN’s specific MIB data exists in that context. Associating a VPN with a context enables service providers to manage networks with multiple VPNs. Creating and associating a context with a VPN makes it unique. The context enables a provider to prevent the users of one VPN from accessing information about other VPN users on the same networking device.

VPN-aware SNMP requires an agreement between SNMP manager and agent entities operating in a VPN environment. The agreement ensures mapping between the SNMP security name and the VPN ID. This mapping is created by using multiple contexts for the SNMP data of different VPNs through the configuration of the SNMP-VACM-MIB. The SNMP-VACM-MIB is configured with views. This configuration allows VPN users with a security name access to the restricted object space. The configuration is associated with your access type in the context that is associated with the user of that VPN.

SNMP request messages undergo three phases of security and access control. Once the access is validated, a response message is sent back with the object values in the context of a VPN:

  • In the first phase, the username is authenticated. This phase ensures that the user is authenticated and authorized for SNMP access.

  • In the second phase, the user is authorized for the SNMP access that is requested to the group objects under consideration of the configured SNMP context. This phase is called the access control phase.

  • In the third phase, access is made to an instance of a table entry. With this third phase, complete retrieval can be based on the SNMP context name.

How to Configure SNMP Support over VPNs—Context-Based Access Control

Configuring an SNMP Context and Associating the SNMP Context with a VPN

Perform this task to configure an SNMP context and to associate the SNMP context with a VPN.


Note
  • Only the following MIBs are context-aware. All the tables in these MIBs can be polled:
    • CISCO-IPSEC-FLOW-MONITOR-MIB
    • CISCO-IPSEC-MIB
    • CISCO-PING-MIB
    • IP-FORWARD-MIB
    • MPLS-LDP-MIB
  • Only two SNMP variables in the IP-FORWARD-MIB can be polled: 1.3.6.1.2.1.4.24.3 (ipCidrRouteNumber - Scalar) and 1.3.6.1.2.1.4.24.4.1 (ipCidrRouteEntry - Table).

SUMMARY STEPS

  1. enable
  2. configure terminal
  3. snmp-server context context-name
  4. ip vrf vrf-name
  5. rd route-distinguisher
  6. context context-name
  7. route-target {import | export | both } route-target-ext-community
  8. end
  9. end

DETAILED STEPS

  Command or Action Purpose
Step 1

enable

Example:


Device> enable

Enables privileged EXEC mode.

  • Enter your password if prompted.

Step 2

configure terminal

Example:


Device# configure terminal

Enters global configuration mode.

Step 3

snmp-server context context-name

Example:


Device(config)# snmp-server context context1

Creates and names an SNMP context.

Step 4

ip vrf vrf-name

Example:


Device(config)# ip vrf vrf1

Configures a VRF routing table and enters VRF configuration mode.

Step 5

rd route-distinguisher

Example:


Device(config-vrf)# rd 100:120

Creates a VPN route distinguisher.

Step 6

context context-name

Example:


Device(config-vrf)# context context1

Associates an SNMP context with a particular VRF.

Note 

Depending on your release, the context command is replaced by the snmp context command. See the Cisco IOS Network Management Command Reference for more information.

Step 7

route-target {import | export | both } route-target-ext-community

Example:


Device(config-vrf)# route-target export 100:1000

(Optional) Creates a route-target extended community for a VRF.

Step 8

end

Example:

Device(config-vrf)# end

Exits interface mode and enters global configuration mode.

Step 9

end

Example:

Device(config)# end

Exits global configuration mode.

Configuring SNMP Support and Associating an SNMP Context

Perform this task to configure SNMP support and associate it with an SNMP context.

SUMMARY STEPS

  1. enable
  2. configure terminal
  3. snmp-server user username group-name [remote host [udp-port port ] [vrf vrf-name ]] {v1 | v2c | v3 [encrypted ] [auth {md5 | sha } auth-password ]} [access [ipv6 nacl ] [priv {des | 3des | aes {128 | 192 | 256 }} privpassword ] {acl-number | acl-name }]
  4. snmp-server group group-name {v1 | v2c | v3 {auth | noauth | priv }} [context context-name ] [read read-view ] [write write-view ] [notify notify-view ] [access [ipv6 named-access-list ] [acl-number | acl-name ]]
  5. snmp-server view view-name oid-tree {included | excluded }
  6. snmp-server enable traps [notification-type ] [vrrp ]
  7. snmp-server community string [view view-name ] [ro | rw ] [ipv6 nacl ] [access-list-number | extended-access-list-number | access-list-name ]
  8. snmp-server host {hostname | ip-address } [vrf vrf-name ] [traps | informs ] [version {1 | 2c | 3 [auth | noauth | priv ]}] community-string [udp-port port ] [notification-type ]
  9. snmp mib community-map community-name [context context-name ] [engineid engine-id ] [security-name security-name ] [target-list upn-list-name ]
  10. snmp mib target list vpn-list-name {vrf vrf-name | host ip-address }
  11. no snmp-server trap authentication vrf

DETAILED STEPS

  Command or Action Purpose
Step 1

enable

Example:


Device> enable

Enables privileged EXEC mode.

  • Enter your password if prompted.

Step 2

configure terminal

Example:


Device# configure terminal

Enters global configuration mode.

Step 3

snmp-server user username group-name [remote host [udp-port port ] [vrf vrf-name ]] {v1 | v2c | v3 [encrypted ] [auth {md5 | sha } auth-password ]} [access [ipv6 nacl ] [priv {des | 3des | aes {128 | 192 | 256 }} privpassword ] {acl-number | acl-name }]

Example:


Device(config)# snmp-server user customer1 group1 v1

Configures a new user to an SNMP group.

Step 4

snmp-server group group-name {v1 | v2c | v3 {auth | noauth | priv }} [context context-name ] [read read-view ] [write write-view ] [notify notify-view ] [access [ipv6 named-access-list ] [acl-number | acl-name ]]

Example:


Device(config)# snmp-server group group1 v1 context context1 read view1 write view1 notify view1

Configures a new SNMP group or a table that maps SNMP users to SNMP views.

  • Use the context context-name keyword argument pair to associate the specified SNMP group with a configured SNMP context.

Step 5

snmp-server view view-name oid-tree {included | excluded }

Example:


Device(config)# snmp-server view view1 ipForward included

Creates or updates a view entry.

Step 6

snmp-server enable traps [notification-type ] [vrrp ]

Example:


Device(config)# snmp-server enable traps

Enables all SNMP notifications (traps or informs) available on your system.

Step 7

snmp-server community string [view view-name ] [ro | rw ] [ipv6 nacl ] [access-list-number | extended-access-list-number | access-list-name ]

Example:


Device(config)# snmp-server community public view view1 rw

Sets up the community access string to permit access to the SNMP.

Step 8

snmp-server host {hostname | ip-address } [vrf vrf-name ] [traps | informs ] [version {1 | 2c | 3 [auth | noauth | priv ]}] community-string [udp-port port ] [notification-type ]

Example:


Device(config)# snmp-server host 10.0.0.1 vrf vrf1 public udp-port 7002

Specifies the recipient of an SNMP notification operation.

Step 9

snmp mib community-map community-name [context context-name ] [engineid engine-id ] [security-name security-name ] [target-list upn-list-name ]

Example:


Device(config)# snmp mib community-map community1 context context1 target-list commAVpn

Associates an SNMP community with an SNMP context, Engine ID, or security name.

Step 10

snmp mib target list vpn-list-name {vrf vrf-name | host ip-address }

Example:


Device(config)# snmp mib target list commAVpn vrf vrf1

Creates a list of target VRFs and hosts to associate with an SNMP community.

Step 11

no snmp-server trap authentication vrf

Example:


Device(config)# no snmp-server trap authentication vrf

(Optional) Disables all SNMP authentication notifications (traps and informs) generated for packets that received on VRF interfaces.

  • Use this command to disable authentication traps only for those packets on VRF interfaces with incorrect community associations.

Configuration Examples for SNMP Support over VPNs—Context-Based Access Control

Example: Configuring Context-Based Access Control

The following configuration example shows how to configure the SNMP Support over VPNs—Context-Based Access Control feature for SNMPv1 or SNMPv2:


Note

Depending on your releases, the context command is replaced by the snmp context command. See the Cisco IOS Network Management Command Reference for more information. 


snmp-server context A
snmp-server context B
ip vrf Customer_A
 rd 100:110
 context A
 route-target export 100:1000
 route-target import 100:1000
!
ip vrf Customer_B
 rd 100:120
 context B
 route-target export 100:2000
 route-target import 100:2000
!
interface Ethernet3/1
 description Belongs to VPN A
 ip vrf forwarding CustomerA
 ip address 192.168.2.1 255.255.255.0
 
interface Ethernet3/2
 description Belongs to VPN B
 ip vrf forwarding CustomerB
 ip address 192.168.2.2 255.255.255.0
snmp-server user commA grp1A v1 
snmp-server user commA grp2A v2c 
snmp-server user commB grp1B v1 
snmp-server user commB grp2B v2c 
snmp-server group grp1A v1 context A read viewA write viewA notify viewA
snmp-server group grp1B v1 context B read viewB write viewB notify viewB 
snmp-server view viewA ipForward included
snmp-server view viewA ciscoPingMIB included
snmp-server view viewB ipForward included
snmp-server view viewB ciscoPingMIB included
snmp-server enable traps
snmp-server host 192.168.2.3 vrf CustomerA commA udp-port 7002
snmp-server host 192.168.2.4 vrf CustomerB commB udp-port 7002
snmp mib community-map commA context A target-list commAvpn
! Configures source address validation
snmp mib community-map commB context B target-list commBvpn
! Configures source address validation
snmp mib target list commAvpn vrf CustomerA 
! Configures a list of VRFs or from which community commA is valid
snmp mib target list commBvpn vrf CustomerB
! Configures a list of VRFs or from which community commB is valid

Additional References

Related Documents

Related Topic

Document Title

Cisco IOS commands

Cisco IOS Master Commands List, All Releases

Cisco IOS SNMP Support Command Reference

Cisco IOS SNMP Support Command Reference

Standards and RFCs

Standard/RFC Title

CBC-DES (DES-56) standard

Symmetric Encryption Protocol

Standard 58

Structure of Management Information Version 2 (SMIv2) >

RFC 1067

A Simple Network Management Protocol

RFC 1091

Telnet terminal-type option

RFC 1098

Simple Network Management Protocol (SNMP)

RFC 1157

Simple Network Management Protocol (SNMP)

RFC 1213

Management Information Base for Network Management of TCP/IP-based internets:MIB-II

RFC 1215

Convention for defining traps for use with the SNMP

RFC 1901

Introduction to Community-based SNMPv2

RFC 1905

Common Management Information Services and Protocol over TCP/IP (CMOT)

RFC 1906

Telnet X Display Location Option

RFC 1908

Simple Network Management Protocol (SNMP)

RFC 2104

HMAC: Keyed-Hashing for Message Authentication

RFC 2206

RSVP Management Information Base using SMIv2

RFC 2213

Integrated Services Management Information Base using SMIv2

RFC 2214

Integrated Services Management Information Base Guaranteed Service Extensions using SMIv2

RFC 2233

The Interface Group MIB using SMIv2

RFC 2271

An Architecture for Describing SNMP Management Frameworks

RFC 2570

Introduction to Version 3 of the Internet-standard Network Management Framework

RFC 2578

Structure of Management Information Version 2 (SMIv2)

RFC 2579

Textual Conventions for SMIv2

RFC 2580

Conformance Statements for SMIv2

RFC 2981

Event MIB

RFC 3413

SNMPv3 Applications

RFC 3415

View-based Access Control Model (VACM) for the Simple Network Management Protocol (SNMP)

MIBs

MIB

MIBs Link

  • Cisco SNMPv2
  • Ethernet-like Interfaces MIB
  • Event MIB
  • Expression MIB Support for Delta, Wildcarding, and Aggregation
  • Interfaces Group MIB (IF-MIB)
  • Interfaces Group MIB Enhancements
  • MIB Enhancements for Universal Gateways and Access Servers

To locate and download MIBs for selected platforms, Cisco IOS XE software releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://www.cisco.com/go/mibs

Technical Assistance

Description

Link

The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.

To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.

Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

http://www.cisco.com/cisco/web/support/index.html

Feature Information for SNMP Support over VPNs—Context-Based Access Control

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Table 1. Feature Information for SNMP Support over VPNs—Context-Based Access Control

Feature Name

Releases

Feature Information

SNMP Support over VPNs—Context-Based Access Control

The SNMP Support over VPNs—Context-Based Access Control feature provides the infrastructure for multiple SNMP context support in Cisco software and VPN-aware MIB infrastructure using the multiple SNMP context support infrastructure.