About secure usernames
Settings for secure usernames are under Administration > System Settings: SNMP ACLs.
SNMP ACLs page - security names
Under Security Names, these configuration options are available:
Add a New Security Name
Displays the controls to add a security name.
Security Name
Specifies a name to identify a requestor allowed to issue gets and sets (v1 and v2c only). The specified requestor can make changes to the view-based access-control model (VACM) security name configuration. This control doesn’t apply to SNMPv3 queries. To restrict v3 USM users from polling a particular subnet, use the RiOS Management ACL feature, located in the Administration > Security: Management ACL page. Traps for v1 and v2c are independent of the security name.
Community String
Specifies the password-like community string to control access. Use a combination of uppercase, lowercase, and numerical characters to reduce the chance of unauthorized access to the SteelHead. Community strings don’t allow printable 7-bit ASCII characters, except for white spaces. Also, the community strings can’t begin with a pound sign (#) or a hyphen (-). If you specify a read-only community string (located in the SNMP Basic page under SNMP Server Settings), it takes precedence over this community name and allows users to access the entire MIB tree from any source host. If this is not desired, delete the read-only community string. To create multiple SNMP community strings on a SteelHead, leave the default public community string and then create a second read-only community string with a different security name. You can also delete the default public string and create two new SNMP ACLs with unique names.
Source IP Address and Mask Bits
Specifies the host IPv4 address and mask bits to which you permit access using the security name and community string.
Add
Adds the security name.
Setting secure groups
In the SNMP ACLS page under Groups, these configuration options are available:
Add a New Group
Displays the controls to add a new group.
Group Name
Specifies a group name.
Security Models and Name Pairs
Enables you to click the + button and select a security model from the drop-down list:
• v1 or v2c displays another drop-down menu. Select a security name.
• v3 (usm)s displays another drop-down menu. Select a user.
To add another Security Model and Name pair, click the plus sign (+).
Add
Adds the group name and security model and name pairs.
Setting secure views
In the SNMP ACLS page under Views, these configuration options are available:
Add a New View
Displays the controls to add a new view.
View Name
Specifies a descriptive view name to facilitate administration.
Includes
Specifies the Object Identifiers (OIDs) to include in the view, separated by commas. For example, .1.3.6.1.4.1. By default, the view excludes all OIDs. You can specify .iso or any subtree or subtree branch. You can specify an OID number or use its string form. For example, .iso.org.dod.internet.private.enterprises.rbt.products.steelhead.system.model
Excludes
Specifies the OIDs to exclude in the view, separated by commas. By default, the view excludes all OIDs.
Add
Adds the view.
Adding an access policy
In the SNMP ACLS page under Access Policies, these configuration options are available:
Add a New Access Policy
Displays the controls to add a new access policy.
Group Name
Specifies a group name from the drop-down list.
Security Level
Determines whether a single atomic message exchange is authenticated. Select one of these from the drop-down list:
• No Auth doesn’t authenticate packets and doesn’t use privacy. This is the default setting.
• Auth authenticates packets but doesn’t use privacy.
• AuthPriv authenticates packets using AES or DES to encrypt messages for privacy.
A security level applies to a group, not to an individual user.
Read View
Specifies a view from the drop-down list.
Add
Adds the policy to the policy list.