8 SNMPv 3 Objectives Architecture Security Access Control

SNMPv 3 changes • Modular Architecture • Security • Access Control • New Message

RFCs • RFC 3410: Introduction • RFC 3411: Architecture • RFC 3412: Message Processing / Dispatch • RFC 3413: SNMP Applications • RFC 3414: Security (USM) • RFC 3415: Access Control (VACM) SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 3

SNMPv 3 reuses • Protocol Operations • Transport Protocol • Data Description Language •

RFCs • RFC 3416: Protocol Operations • RFC 3417: Transport Mappings • RFC 2578: SMIv 2 • RFC 2579: Textual Conventions • RFC 2580: Conformance Statements SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 5

SNMPv 3 - Modular Architecture Command Generator Notification Originator Proxy Forwarder Command Responder Notification Receiver Other SNMP Applications SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 Access Control Subsystem Security Subsystem Message Processing Subsystem Dispatcher SNMP Entity SNMP Engine 6

SNMP Entity - Manager Command Generator PDU Dispatcher Notification Receiver Message Processing Subsystem v 1 MP Message Dispatcher v 2 c. MP v 3 MP UDP IPX . . . Other Transport Mapping other. MP Security Subsystem User-based Security Model Other Security Model Network SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 7

SNMP Entity - Agent MIB Instrumentation Command Responder Proxy Forwarder PDU Dispatcher Message Processing Subsystem v 1 MP Message Dispatcher v 2 c. MP v 3 MP UDP IPX . . . Other Transport Mapping other. MP Notification Originator Security Subsystem Access Control Subsystem User-based Security Model View-based Access Control Model Other Security Model Other Access Control Model Network SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 8

Security Requirements • Secure against - Modification of Information - Masquerade - Message Stream Modification - Disclosure • Not Secure against - Denial of Service - Traffic Analysis SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 9

Security Services 1(3) ? • Permit the operation? - who requested the operation? - is the message unaltered? - is the message timely? SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 USM USM 10

Security Services 2(3) ? - what objects are accessed? - has the requester access

Security Services 3(3) ? • Message encryption? - are we sending secret information? USM

Security Levels • Three Levels: - no authentication / no privacy - authentication / privacy • Examples - Monitoring: no. Auth / no. Priv - Configuration: Auth / no. Priv - Accounting Data: Auth / Priv SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 13

Message Structure msg. Version msg. ID msg. Max. Size msg. Flags Generated/ Processed by Message Processing Model msg. Security. Model scope of authentication msg. Authoritative. Engine. ID msg. Authoritative. Engine. Boots msg. Authoritative. Engine. Time msg. User. Name Generated/ Processed by User Security Model (USM) msg. Authentication. Parameters scope of encryption msg. Privacy. Parameters context. Engine. ID context. Name PDU SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 Scoped PDU (plaintext or encrypted) 14

Message Transmission Retrieve user information Privacy required? Encrypt scoped. Pdu YES set msg. Privacy. Parameters NO msg. Privacy. Parameters null string Authentication required? YES Compute MAC set msg. Authentication. Parameters NO msg. Authentication. Parameters null string SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 15

Message Reception Retrieve message parameters Authentication required? YES Compute MAC; compare to msg. Authentication. Parameters Determine if message is within time window NO NO Privacy required? YES Dencrypt scoped. Pdu SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 16

Engine ID 1(2) • Administratively unique identifier • Format - OCTET STRING; 5 -32 byte long - 1 st bit = 0 Enterprise Method - 1 st bit = 1 Standard Method • Enterprise Method (cisco) - the first 4 bytes are set to private enterprise number (00000009) - the following 8 bytes are assigned in an enterprisespecific method (mac address + 2 random bytes) SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 17

Engine ID 2(2) • Standard Method (cisco) - the first 4 bytes are set to private enterprise number (80000009) - the 5 th byte indicate how the rest are used: 0 – reserved 4 – admin text value 1 – IPv 4 address 5 – admin hex value 2 – IPv 6 address 6. . . 127 – reserved 3 – MAC address specific SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 128. . . 255 – enterprise 18

Reports • A new PDU for Engine to Engine communiction • All messages that can be responded to are reportable • Gives the sender a change to send a correct request • Used for discovery and synchronization • Var-Bind: OID and single value indicating the problem SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 19

Timeliness • Manager needs to keep track of Engine. Boot/Time in the Agent • Agent checks Engine. Boot/Time - wrong value >> report message • Default limit is 150 s SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 20

Key Management • Shared secret keys • 1 key for authentication • 1 key for privacy • Initial setup outside SNMPv 3 • Not accessible via SNMP • Key Localization Process SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 21

Key Localization Process User Password User Key H(User Key+ Remote Engine. ID+ User Key) Localized Key H(User Password) Expand to 220 H(User Key+ Remote Engine. ID+ User Key) MD 5 (16 -octet key) SHA-1 (20 -octet key) . . . Localized Key SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 H(User Key+ Remote Engine. ID+ User Key) Localized Key 22

Agent Discovery • Two step discovery depending on snmp. Security. Level • No. Auth/No. Priv - snmp. Engine. ID • Auth/No. Priv or Auth/Priv - snmp. Engine. Boots - snmp. Engine. Time SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 23

Discovery – No. Auth/No. Priv 1(4) ----- Get Request -----Version = 3 Id = 4 Maximum size = 65520 Message flags = 04. . . . 0 = auth. Flag is off. . . 0. = priv. Flag is off. . . 1. . = reportable. Flag is on Security model = 3 Authoritative engine id = NULL Authoritative engine boots = 0 Authoritative engine time = 0 User name = NULL Authentication parameters = NULL Privacy parameters = NULL Context engine id = NULL Context name = NULL Command = Get request Request ID = 3 Error status = 0 (No error) Error index = 0 No var. Bind. List SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 24

Discovery – No. Auth/No. Priv 2(4) ------- Report ------Version = 3 Id = 4 Maximum size = 2048 Message flags = 00. . . . 0 = auth. Flag is off. . . 0. = priv. Flag is off. . . 0. . = reportable. Flag is off Security model = 3 Authoritative engine id= 00000009020000 D 006024 BF 4 Authoritative engine boots = 23 Authoritative engine time = 248073 User name = NULL Authentication parameters = NULL Privacy parameters = NULL Context engine id = 00000009020000 D 006024 BF 4 Context name = NULL Command = Report Request ID = 3 Error status = 0 (No error) Error index = 0 Object = internet. 6. 3. 15. 1. 1. 4. 0 Value = 17 (counter) SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 25

Discovery – No. Auth/No. Priv 3(4) ----- Get Request -----Version = 3 Id = 5 Maximum size = 65520 Message flags = 04. . . . 0 = auth. Flag is off. . . 0. = priv. Flag is off. . . 1. . = reportable. Flag is on Security model = 3 Authoritative engine id = 00000009020000 D 006024 BF 4 Authoritative engine boots = 0 Authoritative engine time = 0 User name = oper 1 Authentication parameters = NULL Privacy parameters = NULL Context engine id = 00000009020000 D 006024 BF 4 Context name = NULL Command = Get request Request ID = 4 Error status = 0 (No error) Error index = 0 Object = mib-2. 1. 3. 0 Value = NULL SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 26

Discovery – No. Auth/No. Priv 4(4) ------- Response ------Version = 3 Id = 5 Maximum size = 2048 Message flags = 00. . . . 0 = auth. Flag is off. . . 0. = priv. Flag is off. . . 0. . = reportable. Flag is off Security model = 3 Authoritative engine id= 00000009020000 D 006024 BF 4 Authoritative engine boots = 23 Authoritative engine time = 248073 User name = oper 1 Authentication parameters = NULL Privacy parameters = NULL Context engine id = 00000009020000 D 006024 BF 4 Context name = NULL Command = Response Request ID = 4 Error status = 0 (No error) Error index = 0 Object = mib-2. 1. 3. 0 Value = 24807356 SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 27

Discovery – Auth/No. Priv 1(6) ----- Get Request -----Version = 3 Id = 5 Maximum size = 65520 Message flags = 04. . . . 0 = auth. Flag is off. . . 0. = priv. Flag is off. . . 1. . = reportable. Flag is on Security model = 3 Authoritative engine id = NULL Authoritative engine boots = 0 Authoritative engine time = 0 User name = NULL Authentication parameters = NULL Privacy parameters = NULL Context engine id = NULL Context name = NULL Command = Get request Request ID = 4 Error status = 0 (No error) Error index = 0 No var. Bind. List SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 28

Discovery – Auth/No. Priv 2(6) ------- Report ------Version = 3 Id = 5 Maximum size = 1500 Message flags = 00. . . . 0 = auth. Flag is off. . . 0. = priv. Flag is off. . . 0. . = reportable. Flag is off Security model = 3 Authoritative engine id= 00000009020000 D 006024 BF 5 Authoritative engine boots = 1 Authoritative engine time = 1296955 User name = NULL Authentication parameters = NULL Privacy parameters = NULL Context engine id = 00000009020000 D 006024 BF 5 Context name = NULL Command = Report Request ID = 4 Error status = 0 (No error) Error index = 0 Object = internet. 6. 3. 15. 1. 1. 4. 0 Value = 6 (counter) SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 29

Discovery – Auth/No. Priv 3(6) ----- Get Request -----Version = 3 Id = 6 Maximum size = 65520 Message flags = 05. . . . 1 = auth. Flag is on. . . 0. = priv. Flag is off. . . 1. . = reportable. Flag is on Security model = 3 Authoritative engine id = 00000009020000 D 006024 BF 5 Authoritative engine boots = 0 Authoritative engine time = 0 User name = admin 1 Authentication parameters = [<0 E>y<12>r!ECAu�y Privacy parameters = NULL Context engine id = 00000009020000 D 006024 BF 5 Context name = NULL Command = Get request Request ID = 5 Error status = 0 (No error) Error index = 0 Object = mib-2. 1. 3. 0 Value = NULL SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 30

Discovery – Auth/No. Priv 4(6) ------- Report ------Version = 3 Id = 6 Maximum size = 1500 Message flags = 01. . . . 1 = auth. Flag is on. . . 0. = priv. Flag is off. . . 0. . = reportable. Flag is off Security model = 3 Authoritative engine id= 00000009020000 D 006024 BF 5 Authoritative engine boots = 1 Authoritative engine time = 1296955 User name = admin 1 Authentication parameters = 3^q. N<09> NCg<0 B 1 A>v Privacy parameters = NULL Context engine id = 00000009020000 D 006024 BF 5 Context name = NULL Command = Report Request ID = 5 Error status = 0 (No error) Error index = 0 Object = internet. 6. 3. 15. 1. 1. 2. 0 Value = 15 (counter) SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 31

Discovery – Auth/No. Priv 5(6) ----- Get Request -----Version = 3 Id = 7 Maximum size = 65520 Message flags = 05. . . . 1 = auth. Flag is on. . . 0. = priv. Flag is off. . . 1. . = reportable. Flag is on Security model = 3 Authoritative engine id = 00000009020000 D 006024 BF 5 Authoritative engine boots = 1 Authoritative engine time = 1296955 User name = admin 1 Authentication parameters = [<0 E>y<12> r!ECAu�y Privacy parameters = NULL Context engine id = 00000009020000 D 006024 BF 5 Context name = NULL Command = Get request Request ID = 6 Error status = 0 (No error) Error index = 0 Object = mib-2. 1. 3. 0 Value = NULL SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 32

Discovery – Auth/No. Priv 6(6) ------- Response ------Version = 3 Id = 7 Maximum size = 1500 Message flags = 01. . . . 1 = auth. Flag is on. . . 0. = priv. Flag is off. . . 0. . = reportable. Flag is off Security model = 3 Authoritative engine id= 00000009020000 D 006024 BF 5 Authoritative engine boots = 1 Authoritative engine time = 1296955 User name = admin 1 Authentication parameters = � o. Mp. J<1 E>a. Wbf-$ Privacy parameters = NULL Context engine id = 00000009020000 D 006024 BF 5 Context name = NULL Command = Response Request ID = 6 Error status = 0 (No error) Error index = 0 Object = mib-2. 1. 3. 0 Value = 129695850 SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 33

ASI – Command Generator/ Notification Originator Dispatcher Message Processing Model Security Model send. Pdu prepare. Outgoing. Msg generate. Request. Msg Send SNMP Req Msg to Network Receive SNMP Resp Msg from Network prepare. Data. Elements process. Incoming. Msg process. Response. Pdu SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 34

send. Pdu Command Generator/ Notification Originator Dispatcher Message Processing Model Security Model send. Pdu prepare. Outgoing. Msg generate. Request. Msg Send SNMP Req Msg to Network SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 status. Information = Error / send. Pdu( IN transport. Domain IN transport. Address IN message. Processing. Model IN security. Name IN security. Level IN context. Engine. ID IN context. Name IN pdu. Version IN PDU IN expect. Response ) pdu. Handle IP/UDP 192. 10. 20. 1/161 SNMPv 3 USM nisse no. Auth/no. Priv string (12 byte) NULL SNMPv 2 the data unit True (Trap=False) 35

prepare. Outgoing. Msg Command Generator/ Notification Originator Dispatcher Message Processing Model Security Model send. Pdu prepare. Outgoing. Msg generate. Request. Msg Send SNMP Req Msg to Network SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 prepare. Outgoing. Message( IN transport. Domain IN transport. Address IN message. Processing. Model IN security. Name IN security. Level IN context. Engine. ID IN context. Name IN pdu. Version IN PDU IN expect. Response IN send. Pdu. Handle OUT dest. Transport. Domain OUT dest. Transport. Address OUT outgoing. Message. Length ) 36

generate. Request. Msg Command Generator/ Notification Originator Dispatcher Message Processing Model Security Model send. Pdu prepare. Outgoing. Msg generate. Request. Msg Send SNMP Req Msg to Network SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 status. Information = generate. Request. Msg( IN message. Processing. Model IN global. Data IN max. Message. Size IN security. Model IN security. Engine. ID IN security. Name IN security. Level IN scoped. PDU OUT security. Parameters OUT whole. Msg. Length ) 37

ASI – Command Responder Dispatcher Message Processing Model Security Model register. Context. Engine. ID Receive SNMP Req Msg from Network prepare. Data. Elements process. Incoming. Msg process. Pdu return. Response. Pdu prepare. Response. Msg generate. Responset. Msg Send SNMP Resp Msg to Network SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 38

register. Context. Engine. ID Command Responder Dispatcher Message Processing Model Security Model register. Context. Engine. ID Receive SNMP Req Msg from Network prepare. Data. Elements process. Incoming. Msg status. Information = register. Context. Engine. ID( IN context. Engine. ID IN pdu. Type ) process. Pdu SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 39

prepare. Data. Elements Command Responder Dispatcher Message Processing Model Security Model register. Context. Engine. ID Receive SNMP Req Msg from Network prepare. Data. Elements process. Incoming. Msg process. Pdu SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 result = prepare. Data. Elements( IN transport. Domain IN transport. Address IN whole. Msg. Length OUT message. Processing. Model OUT security. Name OUT security. Level OUT context. Engine. ID OUT context. Name OUT pdu. Version OUT PDU OUT pdu. Type OUT send. Pdu. Handle OUT max. Size. Response. Scoped. PDU OUT status. Information OUT state. Reference ) 40

process. Incoming. Msg Command Responder Dispatcher Message Processing Model Security Model register. Context. Engine. ID Receive SNMP Req Msg from Network prepare. Data. Elements process. Incoming. Msg process. Pdu SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 status. Information = process. Incoming. Msg( IN message. Processing. Model IN max. Message. Size IN security. Parameters IN security. Model IN security. Level IN whole. Msg. Length OUT security. Engine. ID OUT security. Name OUT scoped. PDU OUT max. Size. Response. Scoped. PDU OUT security. State. Reference ) 41

process. Pdu Command Responder Dispatcher Message Processing Model Security Model register. Context. Engine. ID Receive SNMP Req Msg from Network prepare. Data. Elements process. Incoming. Msg process. Pdu SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 process. Pdu ( IN message. Processing. Model IN security. Name IN security. Level IN context. Engine. ID IN context. Name IN pdu. Version IN PDU IN max. Size. Response. Scoped. PDU IN state. Reference ) 42

View-based Access Control Model who security. Model where security. Name how security. Model why security. Level what which object-type object-instance context. Name view. Type (read/ write/ notify) vacm. Security. To. Group. Table group. Name vacm. Context. Table variable. Name (OID) vacm. Access. Table view. Name vacm. View. Tree. Family. Table SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 Yes/No 43

Administration 1(2) iso(1). org(3). dod(6). internet(1). snmp. V 2(6). snmp. Modules(3) • SNMPv 2 -MIB • SNMP-FRAMEWORK-MIB • SNMP-MPD-MIB • SNMP-TARGET-MIB • SNMP-COMMUNITY-MIB • SNMP-VIEW-BASED-VACM-MIB • SNMP-USER-BASED-SM-MIB • SNMP-NOTIFICATION-MIB • SNMP-PROXY-MIB SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 44

Administration 2(2) mgmt private snmp. V 2 snmp. Domains snmp. Proxies snmp. Modules snmp. MIB snmp. Framework. MIB snmp. MPDMIB snmp. Target. MIB snmp. Community. MIB snmp. Vacm. MIB snmp. Usm. MIB snmp. Notification. MIB snmp. Proxy. MIB SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 45

Trap Notification – Cisco CLI #show config ! snmp-server engine. ID local 00000009020000 D 006024 BF 4 snmp-server user oper 1 opergr 1 v 3 snmp-server user admin 1 admingr 1 v 3 auth md 5 snmp-server group opergr 1 v 3 noauth read level-2 snmp-server group admingr 1 v 3 auth read level-2 write level-2 snmp-server view level-1 system included snmp-server view level-1 interfaces included snmp-server view level-2 internet included snmp-server community ardbeg view level-1 RO snmp-server community bowmore view level-1 RW snmp-server location Floor 2 snmp-server contact Leif Hagman snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart snmp-server enable traps tty snmp-server host 192. 10. 20. 4 public snmp SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 46

Notify and Target Tables 1(2) 1 2 Notify Table Send all events as traps to receiver trap. Target Table Use IP/UDP and send to 192. 10. 20. 4 on port 162. SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 Params Table SNMPv 1 message with community string public. 47

Notify and Target Tables 2(2) 1 2 3 Filter Table All traps except cisco.

User Setup – Cisco CLI #show config ! snmp-server engine. ID local 00000009020000 D 006024 BF 4 snmp-server user oper 1 opergr 1 v 3 snmp-server user admin 1 admingr 1 v 3 auth md 5 snmp-server group opergr 1 v 3 noauth read level-2 snmp-server group admingr 1 v 3 auth read level-2 write level-2 snmp-server view level-1 system included snmp-server view level-1 interfaces included snmp-server view level-2 internet included snmp-server community ardbeg view level-1 RO snmp-server community bowmore view level-1 RW snmp-server location Floor 2 snmp-server contact Leif Hagman snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart snmp-server enable traps tty snmp-server host 192. 10. 20. 4 public snmp SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 49

USM Tables SNMP & Network Management, © 2010 Easy Software AB, version 6. 02

VACM Setup – Cisco CLI #show config ! snmp-server engine. ID local 00000009020000 D 006024 BF 4 snmp-server user oper 1 opergr 1 v 3 snmp-server user admin 1 admingr 1 v 3 auth md 5 snmp-server group opergr 1 v 3 noauth read level-2 snmp-server group admingr 1 v 3 auth read level-2 write level-2 snmp-server view level-1 system included snmp-server view level-1 interfaces included snmp-server view level-2 internet included snmp-server community ardbeg view level-1 RO snmp-server community bowmore view level-1 RW snmp-server location Floor 2 snmp-server contact Leif Hagman snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart snmp-server enable traps tty snmp-server host 192. 10. 20. 4 public snmp SNMP & Network Management, © 2010 Easy Software AB, version 6. 02 51