Allied Telesis AT-iMG634 - R2 User's Guide download pdf (Page 118)

100

101

SNMP SNMP configuration within the SNMPv3 adminis-

iMG/RG Software Reference Manual (System Configuration)

1-86

1.6.1 SNMP configuration within the SNMPv3 administration framework

The SNMPv3 Administration Framework is a configuration infrastructure for SNMPv3 users, but it can also be

used to remotely configure and administer SNMPv1 and SNMPv2c community strings.

The SNMPv3 security administration framework provides a strong authentication mechanism, authorization

with fine granularity, complete access control, security level controls which include two authentication algo-

rithms

and an optional privacy protocol, and a MIB document for remote configuration.

1.6.1.1 Security

SNMPv3 provides advanced security mechanisms for protecting against threats to management operations.

These security mechanisms are not new: they are taken from the SNMPv2 Draft Standards. The following sec-

tions describe the potential threats and how SNMPv3 protects against these threats.

SNMPv3 addresses in particular the following four threats:

• MASQUERADE

the masquerade threat is when an unauthorized user attempts to carry out management operations by

assuming the identity of an authorized user. SNMPv3 can verify the identity of the originator of the SNMPv3

message.

• MODIFICATION OF INFORMATION

modification of information is the threat that a user will (by malice or error) alter a message in transit

between the source and the destination, thereby carrying out unauthorized management activity. SNMPv3

can verify that the SNMPv3 message was not altered in transit between the originator and the recipient.

• MESSAGE STREAM MODIFICATION

message stream modification occurs when (by malice or error) management messages are reordered,

replayed, or delayed. SNMPv3 can verify that a received message is timely.

1.6.1.2 Mechanisms used by SNMPv3 security

SNMPv3 security protects against masquerade, modification of information, and message stream modification

by using the Hash-based Message Authentication Code (HMAC) with MD5 Message Digest Algorithm (MD5) in

a symmetric, i.e. private, key mode. MD5, defined in RFC1321, takes “as input a message of arbitrary length and

produces as output a fingerprint or ‘message digest’ of the input.”

• Computes an MD5 hash (H)on the concatenation of

• The shared secret key (K), which has been xored with the hexadecimal value ‘36 ’(ipad),

• The SNMP message (text), which contains zero bytes in the digest field, to produce an intermediate

digest, and

• Computes an MD5 hash on the concatenation of

1. Trivial authentication requiring only a correct user names and strong authentication based on an MD5 hash algorithm.

1 2 ... 113 114 115 116 117 118 119 120 121 122 123 ... 997 998

Comments to this Manuals

No comments

Allied Telesis AT-iMG634 - R2 User's Guide Page 118

Comments to this Manuals

Related products and manuals for Gateways/controllers Allied Telesis AT-iMG634 - R2