Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

NMIS supports using SNMPv3 for securing the collection of sensivite sensitive network information.  This is especially important from core switches and routers which if compromised could have a considerable business impact.  This configuration note does not include details about the SNMPv3 protocol, and assumes that people are wanting to use the authPriv (Authentication and Privilegeand Privilege) mode which is the most secure.

...

NMIS9 nameNameOIDNotes
desusmDESPrivProtocol1.3.6.1.6.3.10.1.2.1RFC3411
3desusm3DESPrivProtocol1.3.6.1.4.1.14832.1RFC3411
aes (or aes128)usmAESCfb128PrivProtocol1.3.6.1.4.1.14832.2Blumenthal implementation of SNMPv3
aes192usmAESCfb192PrivProtocol1.3.6.1.4.1.14832.3Blumenthal implementation of SNMPv3
aes256usmAESCfb256PrivProtocol1.3.6.1.4.1.14832.4Blumenthal implementation of SNMPv3
aes192ccusmAESCfb192PrivProtocol

1.3.6.1.4.1.9.12.6.1.1

Cisco implementation of SNMPv3 AES192
aes256ccusmAESCfb256PrivProtocol1.3.6.1.4.1.9.12.6.1.2Cisco implementation of SNMPv3 AES256
aes192c2

usmAES192Cisco2PrivProtocol

1.3.6.1.4.1.9.12.6.1.101A mysterious version 2 of the Cisco implementation, possibly related to pysnmp
aes256c2usmAES256Cisco2PrivProtocol1.3.6.1.4.1.9.12.6.1.102A mysterious version 2 of the Cisco implementation, possibly related to pysnmp

...

On RedHat 8 based systems (including our CentOS Virtual Machine)

Code Block
sudo cp /usr/share/perl5/vendor_perl/Net/SNMP/Security/USM.pm /usr/share/perl5/vendor_perl/Net/SNMP/Security/USM.pm.original
sudo cp /usr/local/nmis9/contrib/perl-net-snmp-256/USM.pm /usr/share/perl5/vendor_perl/Net/SNMP/Security/USM.pm

...

For example on a Fortigate device, the administration GUI allowed setting SHA256 and AES256 but these would not work together, when . When SHA256 and AES256 Cisco were used, the system was very happy.  Many  

Many Cisco devices will support SHA256 but only AES128 (which given the entropy is reasonable "AES-128 would take about 2.61*10^12 years to crack" https://www.ubiqsecurity.com/128bit-or-256bit-encryption-which-to-use/).

NMIS can only support something if the vendor support its.

BTW, at the At the time of writing (March 2023) net-snmp on Linux does not include support for AES256 by default , nor do the SNAP repos, (including SNAP repositories). net-snmp does support AES256, you just need to compile if yourself.

...

This means the remote SNMP agent in the end device (node) does not know what this authentication protocol is.

Related Topics

...

Confirmed working combinations

The below is a list of confirmed working SNMPv3 combinations across a variety of different vendor and operating systems.

This is by no means a comprehensive list of the products we support.

Vendor / Operating SystemSHAAES
Cisco IOSSHA1AES256C
Cisco IOSSHA1AES192C
Cisco IOSSHA1AES128
Cisco NX-OSSHA1AES128
Cisco NX-OSSHA256AES128
FortinetSHA256CAES256C

You may notice that when configuring SNMPv3 on a Cisco IOS device that there is not an explicit AES192C/AES256C in the command, rather it is needed to be defined as AES 192 and/or AES 256. When configuring the device for NMIS, you will need to explicitly tell it to use AES192C/AES256C.

Related Topics