Product Documentation

Configuring the NetScaler for SNMPv3 Queries

Oct 19, 2016

Simple Network Management Protocol Version 3 (SNMPv3) is based on the basic structure and architecture of SNMPv1 and SNMPv2. However, SNMPv3 enhances the basic architecture to incorporate administration and security capabilities, such as authentication, access control, data integrity check, data origin verification, message timeliness check, and data confidentiality.

To implement message level security and access control, SNMPv3 introduces the user-based security model (USM) and the view-based access control model (VACM).

  • User-Based Security Model. The user-based security model (USM) provides message-level security. It enables you to configure users and security parameters for the SNMP agent and the SNMP manager. USM offers the following features:
    • Data integrity: To protect messages from being modified during transmission through the network.
    • Data origin verification: To authenticate the user who sent the message request.
    • Message timeliness: To protect against message delays or replays.
    • Data confidentiality: To protect the content of messages from being disclosed to unauthorized entities or individuals.
  • View-Based Access Control Model. The view-based access control model (VACM) enables you to configure access rights to a specific subtree of the MIB based on various parameters, such as security level, security model, user name, and view type. It enables you to configure agents to provide different levels of access to the MIB to different managers.
The Citrix NetScaler supports the following entities that enable you to implement the security features of SNMPv3:
  • SNMP Engines
  • SNMP Views
  • SNMP Groups
  • SNMP Users

These entities function together to implement the SNMPv3 security features. Views are created to allow access to subtrees of the MIB. Then, groups are created with the required security level and access to the defined views. Finally, users are created and assigned to the groups.

Note: The view, group, and user configuration are synchronized and propagated to the secondary node in a high availability (HA) pair. However, the engine ID is neither propagated nor synchronized as it is unique to each NetScaler appliance.
To implement message authentication and access control, you need to:

Setting the Engine ID

Updated: 2014-08-06

SNMP engines are service providers that reside in the SNMP agent. They provide services such as sending, receiving, and authenticating messages. SNMP engines are uniquely identified using engine IDs.

The NetScaler appliance has a unique engineID based on the MAC address of one of its interfaces. It is not necessary to override the engineID. However, if you want to change the engine ID, you can reset it.

To set the engine ID by using the command line interface

At the command prompt, type the following commands to set the parameters and verify the configuration:
  • set snmp engineId <engineID>
  • show snmp engineId

Example

> set snmp engineId 8000173f0300c095f80c68

To set the engine ID by using configuration utility

Navigate to System > SNMP > Users, click Configure Engine ID and type an engine ID.

Configuring a View

Updated: 2014-08-06

SNMP views restrict user access to specific portions of the MIB. SNMP views are used to implement access control.

To add an SNMP view by using the command line interface

At the command prompt, type the following commands to set the parameters and verify the configuration:
  • add snmp view <name> <subtree> -type ( included | excluded )
  • show snmp view <name>

Example

> add snmp view View1 1.3.6.1.4.1.5951 -type included

To configure an SNMP view by using the configuration utility

Navigate to System > SNMP > Views, and create the SNMP view.

Configuring a Group

Updated: 2014-08-06

SNMP groups are logical aggregations of SNMP users. They are used to implement access control and to define the security levels. You can configure an SNMP group to set access rights for users assigned to that group, thereby restricting the users to specific views.

You need to configure an SNMP group to set access rights for users assigned to that group.

To add an SNMP group by using the command line interface

At the command prompt, type the following commands to set the parameters and verify the configuration:
  • add snmp group <name> <securityLevel> -readViewName <string>
  • show snmp group <name> <securityLevel>

Example

> add snmp group edocs_group2 authPriv -readViewName edocs_read_view

To configure an SNMP group by using the configuration utility

Navigate to System > SNMP > Groups, and create the SNMP group.

Configuring a User

Updated: 2014-08-06

SNMP users are the SNMP managers that the agents allow to access the MIBs. Each SNMP user is assigned to an SNMP group.

You need to configure users at the agent and assign each user to a group.

To configure a user by using the command line interface

At the command prompt, type the following commands to set the parameters and verify the configuration:
  • add snmp user <name> -group <string> [-authType ( MD5 | SHA ) {-authPasswd } [-privType ( DES | AES ) {-privPasswd }]]
  • show snmp user <name>

Where,

authType is the authentication option available while configuring an user. There are two authentication types such as MD5 and SHA.

privType is the encryption option available while configuring an user. There are two types of encryption such as DES of key size 128 bit, and AES of key size 128 bit.

Example

> add snmp user edocs_user -group edocs_group

To configure an SNMP user by using the configuration utility

Navigate to System > SNMP > Users, and create the SNMP user.