- Table of Contents
-
- 12-Network Management and Monitoring Command Reference
- 00-Preface
- 01-System Maintenance and Debugging Commands
- 02-NQA Commands
- 03-NTP Commands
- 04-Clock Monitoring Commands
- 05-IPC Commands
- 06-SNMP Commands
- 07-RMON Commands
- 08-Sampler Commands
- 09-Mirroring Commands
- 10-NetStream Commands
- 11-IPv6 NetStream Commands
- 12-Protocol Packet Statistics Commands
- 13-Information Center Commands
- 14-Flow Logging Commands
- Related Documents
-
Title | Size | Download |
---|---|---|
06-SNMP Commands | 218.53 KB |
display snmp-agent local-engineid
snmp-agent trap if-mib link extended·
snmp-agent usm-user { v1 | v2c }
display snmp-agent community
Syntax
display snmp-agent community [ read | write ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
read: Displays information about SNMP read-only communities.
write: Displays information about SNMP read and write communities.
|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide.
begin: Displays the first line that matches the specified regular expression and all lines that follow.
exclude: Displays all lines that do not match the specified regular expression.
include: Displays all lines that match the specified regular expression.
regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Description
Use the display snmp-agent community command to display community information for SNMPv1 or SNMPv2c.
Examples
# Display the information for all the communities that have been configured.
<Sysname> display snmp-agent community
Community name: aa
Group name: aa
Acl:2001
Storage-type: nonVolatile
Community name: userv1
Group name: userv1
Storage-type: nonVolatile
Field |
Description |
Community name |
Displays the community name created by using the snmp-agent community command or the username created by using the snmp-agent usm-user { v1 | v2c } command. |
Group name |
SNMP group name: · If the community is created by using the snmp-agent community command, the group name is the same as the community name. · If the community is created by using the snmp-agent usm-user { v1 | v2c } command, the name of the group to which the user belongs is displayed. |
Acl |
Number of the ACL that controls the access of the NMSs in the community to the router. Only the NMSs with the IP addresses permitted in the ACL can access the router with the community name. |
Storage-type |
Storage type: · volatile—Settings are lost when the system reboots. · nonVolatile—Settings remain after the system reboots. · permanent—Settings remain after the system reboots and can be modified but not deleted. · readOnly—Settings remain after the system reboots and cannot be modified or deleted. · other—Any other storage type. |
display snmp-agent group
Syntax
display snmp-agent group [ group-name ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
group-name: Specifies the SNMP group name, a case-sensitive string of 1 to 32 characters.
|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide.
begin: Displays the first line that matches the specified regular expression and all lines that follow.
exclude: Displays all lines that do not match the specified regular expression.
include: Displays all lines that match the specified regular expression.
regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Description
Use the display snmp-agent group command to display information for the SNMP agent group, including group name, security model, MIB view, storage type, and so on. Absence of the group-name parameter indicates that information for all groups will be displayed.
Examples
# Display information about all SNMPv3 agent groups.
<Sysname> display snmp-agent group
Group name: groupv3
Security model: v3 noAuthnoPriv
Readview: ViewDefault
Writeview: <no specified>
Notifyview: <no specified>
Storage-type: nonVolatile
Table 2 Output description
Field |
Description |
Group name |
SNMP group name. |
Security model |
Security model of the SNMP group: · authPriv—Authentication with privacy. · authNoPriv—Authentication without privacy. · noAuthNoPriv—No authentication, no privacy. The security model of an SNMPv1 or SNMPv2c group can only be noAuthNoPriv. |
Readview |
Read only MIB view accessible to the SNMP group. |
Writeview |
Write MIB view accessible to the SNMP group. |
Notifyview |
Notify MIB view for the SNMP group. The SNMP users in the group can send traps only for the nodes in the notify MIB view. |
Storage-type |
Storage type, including volatile, nonVolatile, permanent, readOnly, and other (see Table 1). |
display snmp-agent local-engineid
Syntax
display snmp-agent local-engineid [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide.
begin: Displays the first line that matches the specified regular expression and all lines that follow.
exclude: Displays all lines that do not match the specified regular expression.
include: Displays all lines that match the specified regular expression.
regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Description
Use the display snmp-agent local-engineid command to display the local SNMP engine ID.
The local SNMP engine ID uniquely identifies the SNMP engine of the SNMP agent in an SNMP domain.
Every SNMP agent has one SNMP engine to provide services for sending and receiving messages, authenticating and encrypting messages, and controlling access to managed objects.
Examples
# Display the local SNMP agent engine ID.
<Sysname> display snmp-agent local-engineid
SNMP local EngineID: 800007DB7F0000013859
display snmp-agent mib-view
Syntax
display snmp-agent mib-view [ exclude | include | viewname view-name ] [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
exclude: Displays the subtrees excluded from any MIB view.
include: Displays the subtrees included in any MIB view.
viewname view-name: Displays information about the specified MIB view.
|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide.
begin: Displays the first line that matches the specified regular expression and all lines that follow.
exclude: Displays all lines that do not match the specified regular expression.
include: Displays all lines that match the specified regular expression.
regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Description
Use the display snmp-agent mib-view command to display SNMP MIB view information.
If you do not specify any parameter, the command displays all MIB views.
Examples
# Display all SNMP MIB views.
<Sysname> display snmp-agent mib-view
View name:ViewDefault
MIB Subtree:iso
Subtree mask:
Storage-type: nonVolatile
View Type:included
View status:active
View name:ViewDefault
MIB Subtree:snmpUsmMIB
Subtree mask:
Storage-type: nonVolatile
View Type:excluded
View status:active
View name:ViewDefault
MIB Subtree:snmpVacmMIB
Subtree mask:
Storage-type: nonVolatile
View Type:excluded
View status:active
View name:ViewDefault
MIB Subtree:snmpModules.18
Subtree mask:
Storage-type: nonVolatile
View Type:excluded
View status:active
The ViewDefault is the default MIB view. The output shows that all MIB objects in the iso subtree are accessible except for the MIB objects in the snmpUsmMIB, snmpVacmMIB, and snmpModules.18 subtrees.
Table 3 Output description
Field |
Description |
View name |
MIB view name. |
MIB Subtree |
A MIB subtree covered by the MIB view. |
Subtree mask |
MIB subtree mask. |
Storage-type |
Type of the medium where the subtree view is stored. |
View Type |
Access privilege for the MIB subtree in the MIB view: · Included—All objects in the MIB subtree are accessible in the MIB view. · Excluded—None of the objects in the MIB subtree is accessible in the MIB view. |
View status |
The status of the MIB view. |
display snmp-agent statistics
Syntax
display snmp-agent statistics [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide.
begin: Displays the first line that matches the specified regular expression and all lines that follow.
exclude: Displays all lines that do not match the specified regular expression.
include: Displays all lines that match the specified regular expression.
regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Description
Use the display snmp-agent statistics command to display SNMP statistics.
Examples
# Display the statistics on the current SNMP.
<Sysname> display snmp-agent statistics
1684 Messages delivered to the SNMP entity
5 Messages which were for an unsupported version
0 Messages which used a SNMP community name not known
0 Messages which represented an illegal operation for the community supplied
0 ASN.1 or BER errors in the process of decoding
1679 Messages passed from the SNMP entity
0 SNMP PDUs which had badValue error-status
0 SNMP PDUs which had genErr error-status
0 SNMP PDUs which had noSuchName error-status
0 SNMP PDUs which had tooBig error-status (Maximum packet size 1500)
16544 MIB objects retrieved successfully
2 MIB objects altered successfully
7 GetRequest-PDU accepted and processed
7 GetNextRequest-PDU accepted and processed
1653 GetBulkRequest-PDU accepted and processed
1669 GetResponse-PDU accepted and processed
2 SetRequest-PDU accepted and processed
0 Trap PDUs accepted and processed
0 Alternate Response Class PDUs dropped silently
0 Forwarded Confirmed Class PDUs dropped silently
Table 4 Output description
Field |
Description |
Messages delivered to the SNMP entity |
Number of messages that the SNMP agent has received. |
Messages which were for an unsupported version |
Number of messages that had an SNMP version not configured on the SNMP agent. |
Messages which used a SNMP community name not known |
Number of messages that had a community name not configured on the SNMP agent. |
Messages which represented an illegal operation for the community supplied |
Number of messages carrying an operation that the community has no right to perform. |
ASN.1 or BER errors in the process of decoding |
Number of messages that had ASN.1 or BER errors during decoding. |
Messages passed from the SNMP entity |
Number of packets sent by the SNMP agent. |
SNMP PDUs which had badValue error-status |
Number of SNMP PDUs with a badValue error. |
SNMP PDUs which had genErr error-status |
Number of SNMP PDUs with a genErr error. |
SNMP PDUs which had noSuchName error-status |
Number of PDUs with a noSuchName error. |
SNMP PDUs which had tooBig error-status (Maximum packet size 1500) |
Number of PDUs with a tooBig error (the maximum packet size is 1,500 bytes). |
MIB objects retrieved successfully |
Number of MIB objects that have been successfully retrieved. |
MIB objects altered successfully |
Number of MIB objects that have been successfully modified. |
GetRequest-PDU accepted and processed |
Number of get requests that have been received and processed. |
GetNextRequest-PDU accepted and processed |
Number of getNext requests that have been received and processed. |
GetBulkRequest-PDU accepted and processed |
Number of getBulk requests that have been received and processed. |
GetResponse-PDU accepted and processed |
Number of get responses that have been received and processed. |
SetRequest-PDU accepted and processed |
Number of set requests that have been received and processed. |
Trap PDUs accepted and processed |
Number of traps that have been received and processed. |
Alternate Response Class PDUs dropped silently |
Number of dropped response packets. |
Forwarded Confirmed Class PDUs dropped silently |
Number of forwarded packets that have been dropped. |
display snmp-agent sys-info
Syntax
display snmp-agent sys-info [ contact | location | version ] * [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
contact: Displays the contact.
location: Displays the location of the current router.
version: Displays the SNMP version of the SNMP agent.
|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide.
begin: Displays the first line that matches the specified regular expression and all lines that follow.
exclude: Displays all lines that do not match the specified regular expression.
include: Displays all lines that match the specified regular expression.
regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Description
Use the display snmp-agent sys-info command to display the current SNMP system information.
If no keyword is specified, all SNMP agent system information is displayed.
Examples
# Display the current SNMP agent system information.
<Sysname> display snmp-agent sys-info
The contact person for this managed node:
Hangzhou H3C Technologies Co., Ltd.
The physical location of this node:
Hangzhou, China
SNMP version running in the system:
SNMPv3
display snmp-agent trap queue
Syntax
display snmp-agent trap queue [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide.
begin: Displays the first line that matches the specified regular expression and all lines that follow.
exclude: Displays all lines that do not match the specified regular expression.
include: Displays all lines that match the specified regular expression.
regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Description
Use the display snmp-agent trap queue command to display basic information about the trap queue, including trap queue name, queue length and the number of traps in the queue currently.
Related commands: snmp-agent trap life and snmp-agent trap queue-size.
Examples
# Display the current configuration and usage of the trap queue.
<Sysname> display snmp-agent trap queue
Queue name: SNTP
Queue size: 100
Message number: 6
Table 5 Output description
Field |
Description |
Queue name |
Trap queue name |
Queue size |
Trap queue size |
Message number |
Number of traps in the current trap queue |
display snmp-agent trap-list
Syntax
display snmp-agent trap-list [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide.
begin: Displays the first line that matches the specified regular expression and all lines that follow.
exclude: Displays all lines that do not match the specified regular expression.
include: Displays all lines that match the specified regular expression.
regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Description
Use the display snmp-agent trap-list command to display the modules that can generate traps and whether their trap function is enabled or not. If a module comprises of multiple sub-modules, then as long as one sub-module has the trap function enabled, the whole module will be displayed as being enabled with the trap function.
Related commands: snmp-agent trap enable.
Examples
# Display the modules that can generate traps and whether their trap function is enabled or not.
<Sysname> display snmp-agent trap-list
acfp trap enable
bfd trap enable
bgp trap enable
configuration trap enable
flash trap enable
mpls trap enable
ospf trap enable
standard trap enable
system trap enable
vrrp trap enable
Enable traps: 10; Disable traps: 0
If a module can generate traps, its trap function status is enable; if not, disable. You can enable or disable the trap function for a module at the command line interface (CLI).
display snmp-agent usm-user
Syntax
display snmp-agent usm-user [ engineid engineid | username user-name | group group-name ]* [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
1: Monitor level
Parameters
engineid engineid: Displays SNMPv3 user information for the SNMP engine ID identified by engineid. When an SNMPv3 user is created, the system records the current local SNMP entity engine ID of the router. If the engine ID is modified, the user becomes invalid and will become valid again if the engine ID is restored.
username user-name: Displays SNMPv3 user information for a specified user name. It is case-sensitive.
group group-name: Displays SNMPv3 user information for a specified SNMP group name. It is case-sensitive.
|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide.
begin: Displays the first line that matches the specified regular expression and all lines that follow.
exclude: Displays all lines that do not match the specified regular expression.
include: Displays all lines that match the specified regular expression.
regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Description
Use the display snmp-agent usm-user command to display SNMPv3 user information.
Examples
# Display information about SNMPv3 users.
<Sysname> display snmp-agent usm-user username aa
User name: userv3
Group name: mygroupv3
Engine ID: 800063A203000FE240A1A6
Storage-type: nonVolatile
UserStatus: active
User name: userv3code
Group name: groupv3code
Engine ID: 800063A203000FE240A1A6
Storage-type: nonVolatile
UserStatus: active
Table 6 Output description
Field |
Description |
User name |
SNMP user name. |
Group name |
SNMP group name. |
Engine ID |
Engine ID for an SNMP entity. |
Storage-type |
Storage type: · volatile · nonvolatile · permanent · readOnly · other For more information about these storage types, see Table 1. |
UserStatus |
SNMP user status. |
enable snmp trap updown
Syntax
enable snmp trap updown
undo enable snmp trap updown
View
Interface view
Default level
2: System level
Parameters
None
Description
Use the enable snmp trap updown command to enable the trap function for interface state changes on an interface.
Use the undo enable snmp trap updown command to disable the trap function for interface state changes on an interface.
By default, the trap function for interface state changes is enabled.
For an interface to generate Linkup/Linkdown traps when its state changes, you must also enable the Linkup/Linkdown trap function globally by using the snmp-agent trap enable [ standard [ linkdown | linkup ] * ] command.
Related commands: snmp-agent target-host and snmp-agent trap enable.
Examples
# Enable port GigabitEthernet 4/1/1 to send linkup/linkdown SNMP traps in the community public.
<Sysname> system-view
[Sysname] snmp-agent trap enable
[Sysname] snmp-agent target-host trap address udp-domain 10.1.1.1 params securityname public
[Sysname] interface GigabitEthernet 4/1/1
[Sysname-GigabitEthernet4/1/1] enable snmp trap updown
snmp-agent
Syntax
snmp-agent
undo snmp-agent
View
System view
Default level
3: Manage level
Parameters
None
Description
Use the snmp-agent command to enable SNMP agent.
Use the undo snmp-agent command to disable SNMP agent.
By default, SNMP agent is disabled.
You can enable SNMP agent through any commands that begin with snmp-agent.
Examples
# Enable SNMP agent on the router.
<Sysname> system-view
[Sysname] snmp-agent
snmp-agent calculate-password
Syntax
snmp-agent calculate-password plain-password mode { 3desmd5 | 3dessha | md5 | sha } { local-engineid | specified-engineid engineid }
View
System view
Default level
3: Manage level
Parameters
plain-password: Specifies a plaintext authentication or privacy key.
mode: Specifies authentication and privacy algorithms. The three privacy algorithms Advanced Encryption Standard (AES), Triple Data Encryption Standard (3DES), and Data Encryption Standard (DES) are in descending order of security strength. Higher security means more complex implementation mechanism and lower speed. DES is enough to meet general requirements. The Message-Digest Algorithm 5 (MD5) and Secure Hash Algorithm (SHA-1) are the two authentication algorithms. MD5 is faster than SHA-1, while SHA-1 provides higher security than MD5.
· 3desmd5: Converts the plaintext privacy key to an encrypted key for 3DES encryption used together with MD5 authentication. For more information about MD5 and 3DES, see Security Configuration Guide.
· 3dessha: Converts the plaintext privacy key to an encrypted key for 3DES encryption used together with SHA-1 authentication. For more information about SHA-1 and 3DES, see Security Configuration Guide.
· md5: Converts the plaintext authentication key to an encrypted key for MD5 authentication, or converts the plaintext privacy key to an encrypted key for AES or DES encryption used in conjunction with MD5. For more information about AES and DES, see Security Configuration Guide.
· sha: Converts the plaintext authentication key to an encrypted key for SHA-1 authentication, or converts the plaintext privacy key to an encrypted key for AES or DES encryption used in conjunction with SHA-1 authentication.
local-engineid: Uses the local engine ID to calculate the encrypted key. For engine ID configuration, see the snmp-agent local-engineid command.
specified-engineid: Uses a user-defined engine ID to calculate the encrypted key.
engineid: Specifies an SNMP engine ID as a hexadecimal string. It must comprise an even number of hexadecimal characters, which ranges from 10 to 64. All-zero and all-F strings are invalid.
Description
Use the snmp-agent calculate-password command to convert a plaintext key to an encrypted key for authentication or encryption.
This command helps you calculate encrypted authentication and privacy keys for SNMPv3 users that use encrypted authentication and privacy keys. To create an SNMPv3 user, see the snmp-agent usm-user v3 command.
Enable SNMP before you execute the snmp-agent calculate-password command.
The encrypted key converted for SHA authentication is a string of 40 hexadecimal characters. For an authentication key, all of the 40 hexadecimal characters are valid. For a privacy key, only the first 32 hexadecimal characters are valid.
The converted key is valid only under the specified engine ID.
Related commands: snmp-agent usm-user v3.
Examples
# Use local engine ID to convert the plaintext key authkey to an encrypted key for MD5 authentication.
<Sysname> system-view
[Sysname] snmp-agent calculate-password authkey mode md5 local-engineid
The secret key is: 09659EC5A9AE91BA189E5845E1DDE0CC
snmp-agent community
Syntax
snmp-agent community { read | write } community-name [ acl acl-number | mib-view view-name ] *
undo snmp-agent community { read | write } community-name
View
System view
Default level
3: Manage level
Parameters
read: Assigns the specified community the read only access to MIB objects. A read-only community can only inquire MIB information.
write: Assigns the specified community the read and write access to MIB objects. A read and write community can configure MIB information.
community-name: Sets a community name, a string of 1 to 32 characters.
acl acl-number: Specifies a basic ACL to filter NMSs by source IP address. The acl-number argument represents a basic ACL number in the range of 2000 to 2999. In the specified community, only the NMSs with the IP addresses permitted in the ACL can access the SNMP agent.
mib-view view-name: Specifies the MIB view available for the community. The view-name argument represents a MIB view name, a string of 1 to 32 characters. A MIB view represents a set of accessible MIB objects. If no MIB view is specified, the specified community can access the MIB objects in the default view ViewDefault. To create a MIB view, use the snmp-agent mib-view command.
Description
Use the snmp-agent community command to configure an SNMP community.
Use the undo snmp-agent community command to delete a specified community.
This command is for SNMPv1 and SNMPv2c.
A community comprises NMSs and SNMP agents, and is identified by a community name. When routers in a community communicate with each other, they use the community name for authentication. An NMS and an SNMP agent can access each other only when they are configured with the same community name. Typically, public is used as the read-only community name, and private is used as the read and write community name. To improve security, assign your SNMP communities a name other than public and private.
To make sure that the MIB objects are accessible only to a specific NMS, use a basic ACL to identify the source IP address of the NMS. To set the range of the MIB objects available for the community, use a MIB view.
Related commands: snmp-agent mib-view.
Examples
# Create the read-only community readaccess so an NMS can use the protocol SNMPv1 or SNMPv2c and community name readaccess to read the MIB objects in the default view ViewDefault.
<Sysname> system-view
[Sysname] snmp-agent sys-info version v1 v2c
[Sysname] snmp-agent community read readaccess
# Create the read and write community writeaccess so only the host at 1.1.1.1 can use the protocol SNMPv2c and community name writeaccess to read and set the MIB objects in the default view ViewDefault.
<Sysname> system-view
[Sysname] acl number 2001
[Sysname-acl-basic-2001] rule permit source 1.1.1.1 0.0.0.0
[Sysname-acl-basic-2001] rule deny source any
[Sysname-acl-basic-2001] quit
[Sysname] snmp-agent sys-info version v2c
[Sysname] snmp-agent community write writeaccess acl 2001
# Create the read and write community wr-sys-acc so an NMS can use the protocol SNMPv1 or SNMPv2c, community name wr-sys-acc to read and set the MIB objects in the system subtree (OID 1.3.6.1.2.1.1).
<Sysname> system-view
[Sysname] snmp-agent sys-info version v1 v2c
[Sysname] undo snmp-agent mib-view ViewDefault
[Sysname] snmp-agent mib-view included test system
[Sysname] snmp-agent community write wr-sys-acc mib-view test
snmp-agent group
Syntax
SNMPv1 and SNMP v2c:
snmp-agent group { v1 | v2c } group-name [ read-view view-name ] [ write-view view-name ] [ notify-view view-name ] [ acl acl-number ]
undo snmp-agent group { v1 | v2c } group-name
SNMPv3:
snmp-agent group v3 group-name [ authentication | privacy ] [ read-view view-name ] [ write-view view-name ] [ notify-view view-name ] [ acl acl-number ]
undo snmp-agent group v3 group-name [ authentication | privacy ]
View
System view
Default level
3: Manage level
Parameters
v1: Specifies SNMPv1.
v2c: Specifies SNMPv2c.
v3: Specifies SNMPv3.
group-name: Group name, a string of 1 to 32 characters.
authentication: Specifies the security model of the SNMPv3 group to be authentication only (without privacy).
privacy: Specifies the security model of the SNMPv3 group to be authentication and privacy.
read-view view-name: Specifies a read-only MIB view. The view-name represents a MIB view, a string of 1 to 32 characters. The users in the specified group have read only access to the objects included in the MIB view. The default read view is ViewDefault.
write-view view-name: Specifies a read and write MIB view. The view-name argument represents a MIB view, a string of 1 to 32 characters. The users in the specified group have read and write access to the objects included in the MIB view. By default, no write view is configured, which means the NMS cannot perform the write operations to all MIB objects on the router.
notify-view view-name: Specifies a trap MIB view. The view-name argument represents a MIB view, a string of 1 to 32 characters. The system sends traps to the users in the specified group for the objects included in the MIB view. By default, no notify view is configured, which means the agent does not send traps to the NMS.
acl acl-number: Specifies a basic ACL to filter NMSs by source IPv4 address. The acl-number argument represents a basic ACL number in the range of 2000 to 2999. In the specified SNMP group, only the NMSs with the IP addresses permitted in the ACL can access the SNMP agent.
Description
Use the snmp-agent group command to configure an SNMP group and specify its access right.
Use the undo snmp-agent group command to delete an SNMP group.
By default, SNMP groups configured by the snmp-agent group v3 command use a no-authentication-no-privacy security model.
An SNMP group defines security model, access right, and so on. A user in this SNMP group has all these public properties.
Related commands: snmp-agent mib-view and snmp-agent usm-user.
Examples
# Create an SNMP group group1 on an SNMPv3 enabled router, no authentication, no privacy.
<Sysname> system-view
[Sysname] snmp-agent group v3 group1
snmp-agent local-engineid
Syntax
snmp-agent local-engineid engineid
undo snmp-agent local-engineid
View
System view
Default level
3: Manage level
Parameters
engineid: Specifies an SNMP engine ID as a hexadecimal string. It must comprise an even number of hexadecimal characters, which ranges from 10 to 64. All-zero and all-F strings are invalid.
Description
Use the snmp-agent local-engineid command to configure a local engine ID for an SNMP entity.
Use the undo snmp-agent local-engineid command to restore the default local engine ID.
By default, the engine ID of a router is the combination of company ID and router ID. If the newly configured engine ID is not the same as the one used for creating the USM user, the user is invalid.
An SNMP engine ID uniquely identifies an SNMP entity in an SNMP managed network. Make sure that the local SNMP engine ID is unique within your SNMP managed network to avoid communication problems.
If you have configured SNMPv3 users, change the local SNMP engine ID only when necessary. The change can void the SNMPv3 usernames and encrypted keys you have configured.
Typically, the router uses its default engine ID. For ease of remembrance, you can set engine IDs for the routers according to the network planning. For example, if both router 1 and router 2 are on the first floor of building A, you can set the engine ID of router 1 to 000Af0010001, and that of router 2 to 000Af0010002.
Related commands: snmp-agent usm-user.
Examples
# Configure the local engine ID as 123456789A.
<Sysname> system-view
[Sysname] snmp-agent local-engineid 123456789A
snmp-agent log
Syntax
snmp-agent log { all | get-operation | set-operation }
undo snmp-agent log { all | get-operation | set-operation }
View
System view
Default level
3: Manage level
Parameters
all: Enables logging of SNMP GET and SET operations.
get-operation: Enables logging of SNMP GET operation.
set-operation: Enables logging of SNMP SET operation.
Description
Use the snmp-agent log command to enable SNMP logging.
Use the undo snmp-agent log command to restore the default.
By default, SNMP logging is disabled.
Use SNMP logging to record the SNMP operations performed on the SNMP agent for auditing NMS behaviors. The SNMP agent sends log data to the information center. You can configure the information center to output the data to a specific destination as needed.
Examples
# Enable logging SNMP GET operations.
<Sysname> system-view
[Sysname] snmp-agent log get-operation
# Enable logging SNMP SET operations.
<Sysname> system-view
[Sysname] snmp-agent log set-operation
snmp-agent mib-view
Syntax
snmp-agent mib-view { excluded | included } view-name oid-tree [ mask mask-value ]
undo snmp-agent mib-view view-name
View
System view
Default level
3: Manage level
Parameters
excluded: Denies access to any nodes in the specified MIB subtree.
included: Permits access to the nodes in the specified MIB subtree.
view-name: Specify a view name, a string of 1 to 32 characters.
oid-tree: Specifies a MIB subtree by its root node’s OID, such as 1.4.5.3.1, or object name, such as system. An OID is made up of a series of integers. It marks the position of a node in the MIB tree and uniquely identifies a MIB object.
mask mask-value: Sets a MIB subtree mask, a hexadecimal string. Its length must be an even number in the range of 2 to 32. For example, you can specify 0a, aa, but not 0aa. If no subtree mask is specified, the MIB subtree mask is an all-F hexadecimal string. The MIB subtree and the subtree mask together identify a set of objects to be included or excluded from the view.
Description
Use the snmp-agent mib-view command to create or update MIB view information.
Use the undo snmp-agent mib-view command to delete a MIB view.
By default, the system creates the ViewDefault view when the SNMP agent is enabled. In the default MIB view, all MIB objects in the iso subtree but the snmpUsmMIB, snmpVacmMIB, and snmpModules.18 subtrees are accessible.
A MIB view represents a set of MIB objects (or MIB object hierarchies) with certain access privilege. The MIB objects included in the MIB view are accessible while those excluded from the MIB view are inaccessible.
Each view-name oid-tree pair represents a view record. If you specify the same record with different MIB subtree masks multiple times, the last configuration takes effect.
The system can store entries for up to 20 unique MIB view records. Except the four subtrees in the default MIB view, you can create up to 16 unique MIB view records. After you delete the default view with the undo snmp-agent mib-view command, you can create up to 20 unique MIB view records.
Be cautious with deleting the default MIB view. The operation blocks access to any MIB object on the router from NMSs that use the default view.
Related commands: snmp-agent community and snmp-agent group.
Examples
# Include the mib-2 (OID 1.3.6.1) subtree in the mibtest view, exclude the ip subtree from the mibtest view.
<Sysname> system-view
[Sysname] snmp-agent mib-view included mibtest 1.3.6.1
[Sysname] snmp-agent mib-view excluded mibtest ip
[Sysname] snmp-agent community read public mib-view mibtest
An SNMPv1 NMS in the public community can query the objects in the mib-2 subtree, but not any objects (for example, the ipForwarding or ipDefaultTTL node) in the ip subtree.
snmp-agent packet max-size
Syntax
snmp-agent packet max-size byte-count
undo snmp-agent packet max-size
View
System view
Default level
3: Manage level
Parameters
byte-count: Specifies the maximum size (in bytes) of SNMP packets that the SNMP agent can receive or send. The value range is 484 to 17,940, and the default is 1500.
Description
Use the snmp-agent packet max-size command to set the Maximum size (in bytes) of SNMP packets that the SNMP agent can receive or send.
Use the undo snmp-agent packet max-size command to restore the default packet size.
The default maximum SNMP packet size is 1,500 bytes.
If any router on the path to the NMS does not support packet fragmentation, limit the SNMP packet size to prevent large-sized packets from being discarded. In any other cases, the default value is sufficient.
Examples
# Set the maximum SNMP packet size to 1024 bytes.
<Sysname> system-view
[Sysname] snmp-agent packet max-size 1024
snmp-agent sys-info
Syntax
snmp-agent sys-info { contact sys-contact | location sys-location | version { all | { v1 | v2c | v3 }* } }
undo snmp-agent sys-info { contact | location | version { all | { v1 | v2c | v3 }* } }
View
System view
Default level
3: Manage level
Parameters
contact sys-contact: A string of 1 to 200 characters that describes the contact information for system maintenance.
location sys-location: A string of 1 to 200 characters that describes the location of the router.
version: The SNMP version in use.
· all: Specifies SNMPv1, SNMPv2c, and SNMPv3.
· v1: Specifies SNMPv1.
· v2c: Specifies SNMPv2c.
· v3: Specifies SNMPv3.
Description
Use the snmp-agent sys-info command to configure system information, including the contact information, the location, and the SNMP version in use.
Use the undo snmp-agent sys-info contact and undo snmp-agent sys-info location command to restore the default.
Use the undo snmp-agent sys-info version command to disable use of the SNMP function of the specified version.
Configure the SNMP agent with the same SNMP version as the NMS for successful communications between them.
Related commands: display snmp-agent sys-info.
|
NOTE: Network maintenance engineers can use the system contact information to get in touch with the manufacturer in case of network failures. The system location information is a management variable under the system branch as defined in RFC1213-MIB, it identifies the location of the managed object. |
Examples
# Configure the contact information as Dial System Operator at beeper # 27345.
<Sysname> system-view
[Sysname] snmp-agent sys-info contact Dial System Operator at beeper # 27345
snmp-agent target-host
Syntax
snmp-agent target-host trap address udp-domain { ip-address | ipv6 ipv6-address } [ udp-port port-number ] [ vpn-instance vpn-instance-name ] params securityname security-string [ v1 | v2c | v3 [ authentication | privacy ] ]
undo snmp-agent target-host trap address udp-domain { ip-address | ipv6 ipv6-address } params securityname security-string [ vpn-instance vpn-instance-name ]
View
System view
Default level
3: Manage level
Parameters
trap: Specifies a target host for receiving the traps sent by the router.
address: Specifies the IP address of the target host.
udp-domain: Specifies UDP as the transport protocol.
ip-address: Specifies the IPv4 address of the target host.
ipv6 ipv6-address: Specifies the IPv6 address of the target host.
udp-port port-number: Specifies the UDP port for receiving SNMP traps. The default UDP port is 162.
vpn-instance vpn-instance-name: Specifies the MPLS L3VPN to which the target host belongs, where vpn-instance-name is a case-sensitive string of 1 to 31 characters. If the target host is on the public network, do not specify this option. This combination is applicable only in a network supporting IPv4.
params securityname security-string: Specifies authentication related parameters, which is SNMPv1 or SNMPv2c community name or an SNMPv3 user name, a string of 1 to 32 characters.
v1: Specifies SNMPv1.
v2c: Specifies SNMPv2c.
v3: Specifies SNMPv3.
· authentication: Specifies the security model to be authentication without privacy. You must specify the authentication key when you create the SNMPv3 user.
· privacy: Specifies the security model to be authentication with privacy. You must specify the authentication key and privacy key when you create the SNMPv3 user.
Description
Use the snmp-agent target-host command to configure the related settings for a trap target host.
Use the undo snmp-agent target-host command to remove the current settings.
According to the networking requirements, you can use this command for multiple times to configure different settings for a target host, enabling the router to send trap messages to different NMSs.
Make sure that the SNMP agent uses the same UDP port number as the target host for traps. If udp-port port-number is not specified, UDP port 162 is used by default. Port 162 is the SNMP-specified port used for receiving traps, and is used by most NMSs, including iMC and MIB Browser.
Make sure that the SNMP agent uses the same SNMP version as the trap host so the host can receive traps. If none of the keywords v1, v2 and v3 is specified, SNMPv1 is used.
If neither authentication nor privacy is specified, the authentication mode is no authentication, no privacy.
Related commands: enable snmp trap updown, snmp-agent trap enable, snmp-agent trap life, and snmp-agent trap source.
Examples
# Configure the SNMP agent to send SNMPv1 traps to 10.1.1.1 in the community public.
<Sysname> system-view
[Sysname] snmp-agent trap enable standard
[Sysname] snmp-agent target-host trap address udp-domain 10.1.1.1 params securityname public
# Configure the SNMP agent to send SNMPv3 traps to 10.1.1.1 and set the username to v3test.
<Sysname> system-view
[Sysname] snmp-agent trap enable standard
[Sysname] snmp-agent target-host trap address udp-domain 10.1.1.1 vpn-instance vpn1 params securityname v3test v3
snmp-agent trap enable
Syntax
snmp-agent trap enable [ acfp [ client | policy | rule | server ] | bfd | bgp | configuration | flash | fr | mpls | ospf [ process-id ] [ ifauthfail | ifcfgerror | ifrxbadpkt | ifstatechange | iftxretransmit | lsdbapproachoverflow | lsdboverflow | maxagelsa | nbrstatechange | originatelsa | vifcfgerror | virifauthfail | virifrxbadpkt | virifstatechange | viriftxretransmit | virnbrstatechange ] * | pim [ candidatebsrwinelection | electedbsrlostelection | interfaceelection | invalidjoinprune | invalidregister | neighborloss | rpmappingchange ] * | standard [ authentication | coldstart | linkdown | linkup | warmstart ]* | system | vrrp [ authfailure | newmaster ] ]
undo snmp-agent trap enable [ acfp [ client | policy | rule | server ] | bfd | bgp | configuration | flash | fr | mpls | ospf [ process-id ] [ ifauthfail | ifcfgerror | ifrxbadpkt | ifstatechange | iftxretransmit | lsdbapproachoverflow | lsdboverflow | maxagelsa | nbrstatechange | originatelsa | vifcfgerror | virifauthfail | virifrxbadpkt | virifstatechange | viriftxretransmit | virnbrstatechange ] * | pim [ candidatebsrwinelection | electedbsrlostelection | interfaceelection | invalidjoinprune | invalidregister | neighborloss | rpmappingchange ] * | standard [ authentication | coldstart | linkdown | linkup | warmstart ]* | system | vrrp [ authfailure | newmaster ] ]
View
System view
Default level
3: Manage level
Parameters
acfp: Enables SNMP traps for the ACFP module.
· client: ACFP client traps.
· policy: ACFP policy traps.
· rule: ACFP rule traps.
· server: ACFP server traps.
bfd: Enables SNMP traps for the BFD module.
bgp: Enables SNMP traps for the BGP module.
configuration: Enables configuration traps.
flash: Enables Flash-related SNMP traps.
fr: Enables SNMP traps forFrame Relay virtual link change events.
mpls: Enables SNMP traps for the MPLS module.
ospf: Enables SNMP traps for the OSPF module.
· process-id: OSPF process ID, which ranges from 1 to 65535.
· ifauthfail: Interface authentication failure traps.
· ifcfgerror: Interface configuration error traps.
· ifrxbadpkt: Traps for receiving incorrect packets.
· ifstatechange: Interface state change traps.
· iftxretransmit: Traps for the interface to receive and forward packets.
· lsdbapproachoverflow: Traps for LSDB to be overflowed.
· lsdboverflow: Traps for LSDB overflow.
· maxagelsa: Traps for LSA max age.
· nbrstatechange: Traps for neighbor state change.
· originatelsa: Traps for local LSA generation.
· vifcfgerror: Traps for virtual interface configuration error.
· virifauthfail: Traps for virtual interface authentication failure.
· virifrxbadpkt: Traps for virtual interface receiving error packets.
· virifstatechange: Traps for virtual interface state changes.
· viriftxretransmit: Traps for virtual interface receiving and forwarding packets.
· virnbrstatechange: Traps for neighbor state change of the virtual interface.
pim: Enables SNMP traps for the PIM module.
· candidatebsrwinelection: Traps for the winning of a candidate-bootstrap router (C-BSR) in bootstrap router (BSR) election.
· electedbsrlostelection: Traps for the losing of the current BSR in BSR election.
· interfaceelection: Traps for the election of a new DR or DF on an interface.
· invalidjoinprune: Traps for receiving invalid join or prune packets.
· invalidregister: Traps for receiving invalid registration packets.
· neighborloss: Traps for the lost of a neighbor.
· rpmappingchange: Traps for the change of the current RP-set.
standard: Standard traps.
· authentication: Enables the sending of authentication failure traps in the event of authentication failure.
· coldstart: Sends coldstart traps when the router restarts.
· linkdown: Sends linkdown traps when the port is in a linkdown status. It should be configured globally.
· linkup: Sends linkup traps when the port is in a linkup status. It should be configured globally.
· warmstart: Sends warmstart traps when the SNMP restarts.
system: Sends H3C-SYS-MAN-MIB (a private MIB) traps.
vrrp: Traps of the VRRP module.
· authfailure: Traps for VRRP authentication failure.
· newmaster: Enables the sending of VRRP newmaster traps when the router becomes the master.
Description
Use the snmp-agent trap enable command to enable traps globally.
Use the undo snmp-agent trap enable command to disable traps globally.
By default, traps are enabled for all modules except the voice modules.
After you globally enable a trap function for a module, whether the module generates traps also depends on the configuration of the module. For more information, see the sections for each module.
To generate linkUp or linkDown traps when the link state of an interface changes, you must enable the linkUp or linkDown trap function globally by using the snmp-agent trap enable [ standard [ linkdown | linkup ] * ] command and on the interface by using the enable snmp trap updown command.
Related commands: enable snmp trap updown and snmp-agent target-host.
Examples
# Enable the router to send SNMP authentication failure traps to 10.1.1.1 in the community public.
<Sysname> system-view
[Sysname] snmp-agent target-host trap address udp-domain 10.1.1.1 params securityname public
[Sysname] snmp-agent trap enable standard authentication
snmp-agent trap if-mib link extended
Syntax
snmp-agent trap if-mib link extended
undo snmp-agent trap if-mib link extended
View
System view
Default level
3: Manage level
Parameters
None
Description
Use the snmp-agent trap if-mib link extended command to configure the SNMP agent to send extended linkUp/linkDown traps.
Use the undo snmp-agent trap if-mib link extended command to restore the default.
By default, the SNMP agent sends standard linkUp/linkDown traps.
The extended linkUp and linkDown traps add interface description and interface type to the standard linkUp and linkDown traps for fast failure point identification. When you configure the snmp-agent trap if-mib link extended command, make sure that the NMS supports the extended linkUp and linkDown traps.
· A standard linkUp trap is in the following format:
#Apr 24 11:48:04:896 2008 Sysname IFNET/4/INTERFACE UPDOWN:
Trap 1.3.6.1.6.3.1.1.5.4<linkUp>: Interface 983555 is Up, ifAdminStatus is 1, ifOperStatus is 1
· An extended linkUp trap is in the following format:
#Apr 24 11:43:09:896 2008 Sysname IFNET/4/INTERFACE UPDOWN:
Trap 1.3.6.1.6.3.1.1.5.4<linkUp>: Interface 983555 is Up, ifAdminStatus is 1, ifOperStatus is 1, ifDescr is GigabitEthernet3/1/1, ifType is 6
· A standard linkDown trap is in the following format:
#Apr 24 11:47:35:224 2008 Sysname IFNET/4/INTERFACE UPDOWN:
Trap 1.3.6.1.6.3.1.1.5.3<linkDown>: Interface 983555 is Down, ifAdminStatus is 2, ifOperStatus is 2
· An extended linkDown trap is in the following format:
#Apr 24 11:42:54:314 2008 Sysname IFNET/4/INTERFACE UPDOWN:
Trap 1.3.6.1.6.3.1.1.5.3<linkDown>: Interface 983555 is Down, ifAdminStatus is 2, ifOperStatus is 2, ifDescr is GigabitEthernet3/1/1, ifType is 6
When this command is configured, the router sends extended Linkup/Linkdown traps. If the extended messages are not supported on NMS, the router may not be able to resolve the messages.
Examples
# Extend standard Linkup/Linkdown traps defined in RFC.
[Sysname] snmp-agent trap if-mib link extended
snmp-agent trap life
Syntax
snmp-agent trap life seconds
undo snmp-agent trap life
View
System view
Default level
3: Manage level
Parameters
seconds: Specifies the time-out time, in the range of 1 to 2,592,000 seconds.
Description
Use the snmp-agent trap life command to configure the holding time of the traps in the queue. Traps are discarded when the holding time expires.
Use the undo snmp-agent trap life command to restore the default holding time of traps in the queue.
By default, the holding time of SNMP traps in the queue is 120 seconds.
The SNMP module sends traps in queues. As soon as the traps are saved in the trap queue, a timer is started. If traps are not sent out until the timer times out (in other words, the holding time configured by using this command expires), the system removes the traps from the trap sending queue.
Related commands: snmp-agent trap enable and snmp-agent target-host.
Examples
# Configure the holding time for traps as 60 seconds.
<Sysname> system-view
[Sysname] snmp-agent trap life 60
snmp-agent trap queue-size
Syntax
snmp-agent trap queue-size size
undo snmp-agent trap queue-size
View
System view
Default level
3: Manage level
Parameters
size: Specifies the number of traps that can be stored in the trap sending queue, in the range of 1 to 1000.
Description
Use the snmp-agent trap queue-size command to configure the size of the trap sending queue.
Use the undo snmp-agent trap queue-size command to restore the default queue size.
By default, up to 100 traps can be stored in the trap sending queue.
Traps are saved into the trap sending queue when generated. The size of the queue determines the maximum number of the traps that can be stored in the queue. When the size of the trap sending queue reaches the configured value, the newly generated traps are saved into the queue, and the earliest ones are discarded.
Related commands: snmp-agent target-host, snmp-agent trap enable, and snmp-agent trap life.
Examples
# Set the maximum number of traps that can be stored in the trap sending queue to 200.
<Sysname> system-view
[Sysname] snmp-agent trap queue-size 200
snmp-agent trap source
Syntax
snmp-agent trap source interface-type { interface-number | interface-number.subnumber }
undo snmp-agent trap source
View
System view
Default level
3: Manage level
Parameters
interface-type { interface-number | interface-number.subnumber }: Specifies the Layer 3 interface type and interface number. The parameter interface-number represents the main interface number. The parameter subnumber represents the subinterface number and ranges from 1 to 4,094.
Description
Use the snmp-agent trap source command to specify the source IP address contained in the Trap message.
Use the undo snmp-agent trap source command to restore the default.
By default, SNMP chooses the IP address of an interface to be the source IP address of the trap.
Upon the execution of this command, the system uses the primary IP address of the specified interface as the source IP address of the traps, and the NMS uses this IP address to uniquely identify the agent. Even if the agent sends out traps through different interfaces, the NMS uses this IP address to filter all traps sent from the agent.
Before you can configure the IP address of a particular interface as the source IP address of the trap, make sure that the interface already exists and that it has a legal IP address. If the configured interface does not exist, the configuration fails. If the specified IP address is illegal, the configuration becomes invalid. When a legal IP address is configured for the interface, the configuration automatically becomes valid.
Related commands: snmp-agent target-host and snmp-agent trap enable.
Examples
# Configure the IP address for port GigabitEthernet 4/1/1 as the source address for traps.
<Sysname> system-view
[Sysname] snmp-agent trap source GigabitEthernet 4/1/1
snmp-agent usm-user { v1 | v2c }
Syntax
snmp-agent usm-user { v1 | v2c } user-name group-name [ acl acl-number ]
undo snmp-agent usm-user { v1 | v2c } user-name group-name
View
System view
Default level
3: Manage level
Parameters
v1: Specifies SNMPv1.
v2c: Specifies SNMPv2c.
user-name: User name, a case-sensitive string of 1 to 32 characters.
group-name: Group name, a case-sensitive string of 1 to 32 characters.
acl acl-number: Specifies a basic ACL to filter NMSs by source IPv4 address. The acl-number argument represents a basic ACL number in the range of 2000 to 2999. Only the NMSs with the IPv4 addresses permitted in the ACL can use the specified username (community name) to access the SNMP agent.
Use the snmp-agent usm-user { v1 | v2c } command to add a user to an SNMP group.
Use the undo snmp-agent usm-user { v1 | v2c } command to delete a user from an SNMP group.
Make sure that you have created the SNMPv1 or SNMPv2c group.
When you create an SNMPv1 or SNMPv2c user, the system automatically creates a read-only community that has the same name as the SNMPv1 or SNMPv2c username. To change the access right of this community to write access, use the snmp-agent community command or the snmp-agent group { v1 | v2c } command. To display the SNMPv1 and SNMPv2c communities created in this way, use the display snmp-agent community command.
The snmp-agent usm-user { v1 | v2c } command enables managing SNMPv1 and SNMPv2c users in the same way as managing SNMPv3 users. It does not affect the way of configuring SNMPv1 and SNMPv2c communities on the NMS.
Related commands: snmp-agent community, snmp-agent group, and snmp-agent usm-user v3.
Examples
# Add the user userv2c to the SNMPv2c group readCom so an NMS can use the protocol SNMPv2c and the read-only community name userv2c to access the SNMP agent.
<Sysname> system-view
[Sysname] snmp-agent sys-info version v2c
[Sysname] snmp-agent group v2c readCom
[Sysname] snmp-agent usm-user v2c userv2c readCom
# Add the user userv2c in the SNMPv2c group readCom so only the NMS at 1.1.1.1 can use the protocol SNMPv2c and read-only community name userv2c to access the SNMP agent.
<Sysname> system-view
[Sysname] acl number 2001
[Sysname-acl-basic-2001] rule permit source 1.1.1.1 0.0.0.0
[Sysname-acl-basic-2001] rule deny source any
[Sysname-acl-basic-2001] quit
[Sysname] snmp-agent sys-info version v2c
[Sysname] snmp-agent group v2c readCom
[Sysname] snmp-agent usm-user v2c userv2c readCom acl 2001
snmp-agent usm-user v3
Syntax
snmp-agent usm-user v3 user-name group-name [ [ cipher ] [ authentication-mode { md5 | sha } auth-password [ privacy-mode { 3des | aes128 | des56 } priv-password ] ] [ acl acl-number ]
undo snmp-agent usm-user v3 user-name group-name { local | engineid engineid-string }
View
System view
Default level
3: Manage level
Parameters
user-name: User name, a case-sensitive string of 1 to 32 characters.
group-name: Group name, a case-sensitive string of 1 to 32 characters.
cipher: Specifies that auth-password and priv-password are encrypted keys, which can be calculated by using the snmp-agent calculate-password command.
authentication-mode: Specifies an authentication algorithm. MD5 is faster than SHA, while SHA provides a higher security than MD5.
· md5: Specifies the MD5 authentication algorithm. For more information about MD5, see Security Configuration Guide.
· sha: Specifies the SHA-1 authentication protocol algorithm. For more information about SHA, see Security Configuration Guide.
auth-password: Authentication key. If the cipher keyword is not specified, auth-password represents a plaintext key, a string of 1 to 64 visible characters. If the cipher keyword is specified, auth-password represents an encrypted key. If the md5 keyword is specified, auth-password is a string of 32 hexadecimal characters. If the sha keyword is specified, auth-password is a string of 40 hexadecimal characters.
privacy-mode: Specifies an encryption algorithm for privacy. The three encryption algorithms AES, 3DES, and DES are in descending order in terms of security. Higher security means more complex implementation mechanism and lower speed. DES is enough to meet general requirements.
· 3des: Specifies the 3DES algorithm. For more information about 3DES, see Security Configuration Guide.
· des56: Specifies the DES algorithm. For more information about DES, see Security Configuration Guide.
· aes128: Specifies the AES algorithm. For more information about AES, see Security Configuration Guide.
priv-password: Specifies a privacy key. If the cipher keyword is not specified, priv-password represents a plaintext key, a string of 1 to 64 characters. If the cipher keyword is specified, priv-password represents an encrypted key. If the md5 keyword is specified, priv-password is a string of 32 hexadecimal characters. If the sha keyword is specified, priv-password is a string of 40 hexadecimal characters.
acl acl-number: Specifies a basic ACL to filter NMSs by source IPv4 address. The acl-number argument represents a basic ACL number in the range of 2000 to 2999. Only the NMSs with the IPv4 addresses permitted in the ACL can use the specified username to access the SNMP agent.
local: Represents a local SNMP entity user.
engineid engineid-string: Specifies an SNMP engine ID as a hexadecimal string. The engineid-string argument must comprise an even number of hexadecimal characters, which ranges from 10 to 64. All-zero and all-F strings are invalid.
Description
Use the snmp-agent usm-user v3 command to add an SNMPv3 user to an SNMP group.
Use the undo snmp-agent usm-user v3 command to delete an SNMPv3 user from an SNMP group.
You must create an SNMPv3 user for the agent and the NMS to use SNMPv3.
You must create an SNMP group before you assign an SNMP user to the group. Otherwise, the user cannot take effect after it is created. An SNMP group can contain multiple users. It defines SNMP objects accessible to the group of users in the MIB view and specifies whether to enable authentication and privacy functions. The authentication and encryption algorithms are defined when a user is created.
· If you specify the cipher keyword, the system considers the arguments auth-password and priv-password as encrypted keys, and does not encrypt them when executing this command.
· If you do not specify the cipher keyword, the system considers the arguments auth-password and priv-password as plaintext keys, and encrypts them when executing this command.
Specify the cipher keyword when you roll back, copy or paste the running configuration. For example, assume that you have created SNMPv3 user A and configured both authentication and privacy keys of this user as xyz. To make the configuration of user A still effective after the configuration is copied, pasted, and re-executed, specify the cipher keyword when you create user A with this command. Otherwise, after you copy, paste, or re-execute the configuration, the router creates user A, but the corresponding keys are not xyz.
When you use the snmp-agent usm-user v3 cipher command, the pri-password argument in this command can be obtained by the snmp-agent calculate-password command. To make the calculated encrypted key applicable to the snmp-agent usm-user v3 cipher command and have the same effect as that in the snmp-agent usm-user v3 cipher command, make sure that the same encryption algorithm is specified for the two commands and the local engine ID specified in the snmp-agent usm-user v3 cipher command is consistent with the SNMP entity engine ID specified in the snmp-agent calculate-password command.
When you execute this command repeatedly to configure the same user (namely, the user names are the same, no limitation to other keywords and arguments), the last configuration takes effect.
Remember the username and the plaintext password when you create a user. A plaintext password is required when the NMS accesses the SNMP agent.
Related commands: snmp-agent calculate-password, snmp-agent group, and snmp-agent usm-user { v1 | v2c }.
Examples
# Add the user testUser to the SNMPv3 group testGroup. Configure the security model as authentication without privacy, the authentication algorithm as MD5, the plaintext key as authkey.
<Sysname> system-view
[Sysname] snmp-agent group v3 testGroup authentication
[Sysname] snmp-agent usm-user v3 testUser testGroup authentication-mode md5 authkey
To access the SNMP agent, specifically, the default view (ViewDefault) in this example, the NMS can use the protocol SNMPv3, username testUser, authentication algorithm MD5, and authentication key authkey.
# Add the user testUser to the SNMPv3 group testGroup. Configure the security model as authentication and privacy, the authentication algorithm as MD5, the privacy algorithm as DES56, the plain-text authentication key as authkey, and the plain-text privacy key as prikey.
<Sysname> system-view
[Sysname] snmp-agent group v3 testGroup privacy
[Sysname] snmp-agent usm-user v3 testUser testGroup authentication-mode md5 authkey privacy-mode des56 prikey
To access the SNMP agent, specifically, the default view (ViewDefault) in this example, the NMS must use the protocol SNMPv3, username testUser, authentication algorithm MD5, authentication key authkey, privacy algorithm DES, and privacy key prikey.
# Add the user testUser to the SNMPv3 group testGroup with the cipher keyword specified. Configure the security model as authentication and privacy, the authentication algorithm as MD5, the privacy algorithm as DES56, and specify the authentication key authkey and the privacy key prikey in their encrypted forms.
<Sysname> system-view
[Sysname] snmp-agent group v3 testGroup privacy
[Sysname] snmp-agent calculate-password authkey mode md5 local-engineid
The secret key is: 09659EC5A9AE91BA189E5845E1DDE0CC
[Sysname] snmp-agent calculate-password prikey mode md5 local-engineid
The secret key is: 800D7F26E786C4BECE61BF01E0A22705
[Sysname] snmp-agent usm-user v3 testUser testGroup cipher authentication-mode md5 09659EC5A9AE91BA189E5845E1DDE0CC privacy-mode des56 800D7F26E786C4BECE61BF01E0A22705
To access the SNMP agent, specifically, the default view (ViewDefault) in this example, the NMS must use the protocol SNMPv3, username testUser, authentication algorithm MD5, authentication key authkey, privacy algorithm DES, and privacy key prikey.
display mib-style
Syntax
display mib-style [ | { begin | exclude | include } regular-expression ]
View
Any view
Default level
3: Manage level
Parameters
|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide.
begin: Displays the first line that matches the specified regular expression and all lines that follow.
exclude: Displays all lines that do not match the specified regular expression.
include: Displays all lines that match the specified regular expression.
regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.
Description
Use the display mib-style command to display the MIB style of the router.
Two MIB styles are available on the router: new and compatible. After obtaining the MIB style, you can select matched H3C network management software based on the MIB style.
Related commands: mib-style.
Examples
# After getting the router ID from node sysObjectID, you find that it is an H3C router, and hope to know the current MIB style or the MIB style after next boot of the router.
<Sysname> display mib-style
Current MIB style: new
Next reboot MIB style: new
The above output information indicates that the current MIB style of the router is new, and the MIB style after next boot is still new.
mib-style
Syntax
mib-style [ new | compatible ]
View
System view
Default level
3: Manage level
Parameters
new: Specifies the MIB style of the router as H3C new; that is, both sysOID and private MIB of the router are located under the H3C enterprise ID 25506.
compatible: Specifies the MIB style of the router as H3C compatible; that is, sysOID of the router is located under the H3C enterprise ID 25506, and private MIB is located under the enterprise ID 2011.
Description
Use the mib-style command to set the MIB style of the router.
By default, the MIB style of the router is new.
The configuration takes effect only after the router reboots.
Examples
# Modify the MIB style of the router as compatible.
<Sysname> system-view
[Sysname] mib-style compatible
[Sysname] quit
<Sysname> display mib-style
Current MIB style: new
Next reboot MIB style: compatible
<Sysname> reboot