Product Documentation
ADC
14.1 - Current Release 13.1 13.0 12.1
View PDF

Configuring Citrix ADC for SNMPv3 queries

September 14, 2021
Contributed by: 
S C

Simple Network Management Protocol Version 3 (SNMPv3) is based on the basic structure and architecture of SNMPv1 and SNMPv2. However, SNMPv3 enhances the basic architecture to incorporate administration and security capabilities, such as authentication, access control, data integrity check, data origin verification, message timeliness check, and data confidentiality.

To implement message level security and access control, SNMPv3 introduces the user-based security model (USM) and the view-based access control model (VACM).

  • User-Based Security Model. The user-based security model (USM) provides message-level security. It enables you to configure users and security parameters for the SNMP agent and the SNMP manager. USM offers the following features:
    • Data integrity: To protect messages from being modified during transmission through the network.
    • Data origin verification: To authenticate the user who sent the message request.
    • Message timeliness: To protect against message delays or replays.
    • Data confidentiality: To protect the content of messages from being disclosed to unauthorized entities or individuals.
  • View-Based Access Control Model. The view-based access control model (VACM) enables you to configure access rights to a specific subtree of the MIB based on various parameters, such as security level, security model, user name, and view type. It enables you to configure agents to provide different levels of access to the MIB to different managers.

Citrix ADC supports the following entities that enable you to implement the security features of SNMPv3:

  • SNMP Engines
  • SNMP Views
  • SNMP Groups
  • SNMP Users

These entities function together to implement the SNMPv3 security features. Views are created to allow access to subtrees of the MIB. Then, groups are created with the required security level and access to the defined views. Finally, users are created and assigned to the groups.

Note:

The view, group, and user configuration are synchronized and propagated to the secondary node in a high availability (HA) pair. However, the engine ID is neither propagated nor synchronized as it is unique to each Citrix ADC appliance.

To implement message authentication and access control, you need to do the following:

Setting the engine ID

SNMP engines are service providers that reside in the SNMP agent. They provide services such as sending, receiving, and authenticating messages. SNMP engines are uniquely identified using engine IDs.

The Citrix ADC appliance has a unique engineID based on the MAC address of one of its interfaces. It is not necessary to override the engineID. However, if you want to change the engine ID, you can reset it.

To set the engine ID by using the command line interface

At the command prompt, type the following commands to set the parameters and verify the configuration:

  • set snmp engineId <engineID>
  • show snmp engineId

Example

> set snmp engineId 8000173f0300c095f80c68

To set the engine ID by using GUI

Navigate to System > SNMP > Users, click Configure Engine ID and type an engine ID.

Configure a view

SNMP views restrict user access to specific portions of the MIB. SNMP views are used to implement access control.

To add an SNMP view by using the command line interface

At the command prompt, type the following commands to set the parameters and verify the configuration:

  • add snmp view <name> <subtree> -type ( included | excluded )
  • show snmp view <name>
  • rm snmp view <name> <subtree>

Where,

Name. Name for the SNMPv3 view. It can consist of 1 to 31 characters that include uppercase and lowercase letters, numbers, and the hyphen (-), period (.) pound (#), space ( ), at sign (@), equals (=), colon (:), and underscore (_) characters. You should choose a name that helps identify the SNMPv3 view.

Subtree. A particular branch (subtree) of the MIB tree that you want to associate with this SNMPv3 view. You must specify the subtree as an SNMP OID. This is an argument of maximum Length: 99.

type. Include or exclude the subtree, specified by the subtree parameter, in or from this view. This setting can be useful when you have included a subtree, such as A, in an SNMPv3 view and you want to exclude a specific subtree of A, such as B, from the SNMPv3 view. This is a mandatory argument. Possible values: included, excluded.

Examples

add snmp view SNMPv3test 1.1.1.1 -type included sh snmp view SNMPv3test rm snmp view SNMPv3test 1.1.1.1

To configure an SNMP view by using the GUI

Navigate to System > SNMP > Views,and create the SNMP view.

Configure a group

SNMP groups are logical aggregations of SNMP users. They are used to implement access control and to define the security levels. You can configure an SNMP group to set access rights for users assigned to that group, thereby restricting the users to specific views.

You need to configure an SNMP group to set access rights for users assigned to that group.

To add an SNMP group by using the command line interface

At the command prompt, type the following commands to set the parameters and verify the configuration:

  • add snmp group <name> <securityLevel> -readViewName <string>
  • show snmp group <name> <securityLevel>

Where,

Name. Name for the SNMPv3 group. Can consist of 1 to 31 characters that include uppercase and lowercase letters, numbers, and the hyphen (-), period (.) pound (#), space ( ), at sign (@), equals (=), colon (:), and underscore (_) characters. You should choose a name that helps identify the SNMPv3 group.

securityLevel. Security level required for communication between the Citrix ADC appliance and the SNMPv3 users who belong to the group. Specify one of the following options:

noAuthNoPriv. Require neither authentication nor encryption.

authNoPriv. Require authentication but no encryption.

authPriv. Require authentication and encryption. Note: If you specify authentication, you must specify an encryption algorithm when you assign an SNMPv3 user to the group. If you also specify encryption, you must assign both an authentication and an encryption algorithm for each group member. This is a mandatory argument. Possible values: noAuthNoPriv, authNoPriv, authPriv.

readViewName. Name of the configured SNMPv3 view that you want to bind to this SNMPv3 group. An SNMPv3 user bound to this group can access the subtrees that are bound to this SNMPv3 view as type INCLUDED, but cannot access the ones that are type EXCLUDED. If the Citrix ADC appliance has multiple SNMPv3 view entries with the same name, all such entries are associated with the SNMPv3 group. This is a mandatory argument. Maximum Length: 31

To configure an SNMP group by using the GUI

Navigate to System > SNMP > Groups, and create the SNMP group.

Configuring a user

SNMP users are the SNMP managers that the agents allow to access the MIBs. Each SNMP user is assigned to an SNMP group.

You need to configure users at the agent and assign each user to a group.

To configure a user by using the command line interface

At the command prompt, type the following commands to set the parameters and verify the configuration:

  • add snmp user <name> -group <string> [-authType ( MD5 | SHA ) {-authPasswd } [-privType ( DES | AES ) {-privPasswd }]]
  • show snmp user <name>

Where,

authType is the authentication option available while configuring an user. There are two authentication types such as MD5 and SHA.

privType is the encryption option available while configuring an user. There are two types of encryption such as DES of key size 128 bit, and AES of key size 128 bit.

Example 

> add snmp user edocs_user -group edocs_group
<!--NeedCopy-->

To configure an SNMP user by using the GUI

Navigate to System > SNMP > Users, and create the SNMP user.

Configuring Citrix ADC for SNMPv3 queries
September 14, 2021
Contributed by: 
S C
September 14, 2021
Contributed by: 
S C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.