ADC

Configuring SNMP in FIPS mode

September 14, 2021

Contributed by:

FIPS mode requires Simple Network Management Protocol version 3 (SNMPv3) with the authentication and privacy (authPriv) option. SNMP version 1 and version 2 use a community string mechanism to provide secured access to management data. The community string is sent as clear text between an SNMP manager and an SNMP agent. This type of communication is unsecure, allowing intruders to access SNMP information on the network.

The SNMPv3 protocol uses the User-based Security Model (USM) and View-based Access Control Model (VACM) to authenticate and control management access to SNMP messaging data. SNMPv3 has three security levels: no authentication no privacy (noAuthNoPriv), authentication and no privacy (authNoPriv), and authentication and privacy (authPriv).

Enabling FIPS mode and restarting the Citrix ADC appliance removes the following SNMP configurations from the appliance:

Community configuration for SNMPv1 and SNMPv2 protocols.
SNMPv3 groups configured with the noAuthNoPriv or authNoPriv security-level option.
Traps configured for SNMPv1 or SNMPv2, or SNMPv3 with the noAuthNoPriv security-level option.

After restarting the appliance, configure SNMPv3 with the authPriv option. For more information about configuring authPriv option in SMNP v3, see SNMPV3 topic

Note:

Enabling FIPS mode and restarting your appliance blocks execution of the following SNMP trap and group commands:

 add snmp community <communityName> <permissions>

 add snmp trap <trapClass> <trapDestination> ... [-version: v1/v2]   [-td <positive_integer>] [-destPort <port>] [-communityName <string>] [-srcIP <ip_addr|ipv6_addr>] [-severity <severity>] [-allPartitions ( ENABLED | DISABLED )]

 add snmp group <name> <securityLevel : noAuthNoPriv/ authNoPriv > -readViewName <string>

 bind snmp trap specific <TrapIp>-userName <v3 user name> -securityLevel <noAuthNoPriv/ authNoPriv>
<!--NeedCopy-->

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Configuring SNMP in FIPS mode

September 14, 2021

Contributed by:

September 14, 2021

Contributed by:

Configuring SNMP in FIPS mode

In this article