draft-ietf-snmpv3-appl-v2-03.txt   rfc2573.txt 
INTERNET-DRAFT David B. Levi
SNMP Research, Inc. Network Working Group D. Levi
Paul Meyer Request for Comments: 2573 SNMP Research, Inc.
Secure Computing Corporation Obsoletes: 2273 P. Meyer
Bob Stewart Category: Standards Track Secure Computing Corporation
B. Stewart
Cisco Systems Cisco Systems
10 Feb 1999 April 1999
SNMP Applications SNMP Applications
<draft-ietf-snmpv3-appl-v2-03.txt>
Status of this Memo Status of this Memo
This document is an Internet-Draft and is in full conformance with This document specifies an Internet standards track protocol for the
all provisions of Section 10 of RFC2026. Internet-Drafts are working Internet community, and requests discussion and suggestions for
documents of the Internet Engineering Task Force (IETF), its areas, improvements. Please refer to the current edition of the "Internet
and its working groups. Note that other groups may also distribute Official Protocol Standards" (STD 1) for the standardization state
working documents as Internet-Drafts. and status of this protocol. Distribution of this memo is unlimited.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html
Copyright Notice Copyright Notice
Copyright (C) The Internet Society (1999). All Rights Reserved. Copyright (C) The Internet Society (1999). All Rights Reserved.
Abstract Abstract
This memo describes five types of SNMP applications which make use of This memo describes five types of SNMP applications which make use of
an SNMP engine as described in [SNMP-ARCH]. The types of application an SNMP engine as described in [RFC2571]. The types of application
described are Command Generators, Command Responders, Notification described are Command Generators, Command Responders, Notification
Originators, Notification Receivers, and Proxy Forwarders. Originators, Notification Receivers, and Proxy Forwarders.
This memo also defines MIB modules for specifying targets of This memo also defines MIB modules for specifying targets of
management operations, for notification filtering, and for proxy management operations, for notification filtering, and for proxy
forwarding. forwarding.
This memo will obsolete RFC2273. Table Of Contents
Table Of Contents
1 Overview ..................................................... 4 1 Overview ..................................................... 2
1.1 Command Generator Applications ............................. 4 1.1 Command Generator Applications ............................. 3
1.2 Command Responder Applications ............................. 4 1.2 Command Responder Applications ............................. 3
1.3 Notification Originator Applications ....................... 5 1.3 Notification Originator Applications ....................... 3
1.4 Notification Receiver Applications ......................... 5 1.4 Notification Receiver Applications ......................... 3
1.5 Proxy Forwarder Applications ............................... 5 1.5 Proxy Forwarder Applications ............................... 4
2 Management Targets ........................................... 7 2 Management Targets ........................................... 5
3 Elements Of Procedure ........................................ 7 3 Elements Of Procedure ........................................ 6
3.1 Command Generator Applications ............................. 7 3.1 Command Generator Applications ............................. 6
3.2 Command Responder Applications ............................. 11 3.2 Command Responder Applications ............................. 9
3.3 Notification Originator Applications ....................... 17 3.3 Notification Originator Applications ....................... 14
3.4 Notification Receiver Applications ......................... 21 3.4 Notification Receiver Applications ......................... 17
3.5 Proxy Forwarder Applications ............................... 23 3.5 Proxy Forwarder Applications ............................... 19
3.5.1 Request Forwarding ....................................... 24 3.5.1 Request Forwarding ....................................... 20
3.5.1.1 Processing an Incoming Request ......................... 24 3.5.1.1 Processing an Incoming Request ......................... 20
3.5.1.2 Processing an Incoming Response ........................ 27 3.5.1.2 Processing an Incoming Response ........................ 23
3.5.1.3 Processing an Incoming Internal-Class PDU .............. 28 3.5.1.3 Processing an Incoming Internal-Class PDU .............. 24
3.5.2 Notification Forwarding .................................. 29 3.5.2 Notification Forwarding .................................. 25
4 The Structure of the MIB Modules ............................. 33 4 The Structure of the MIB Modules ............................. 28
4.1 The Management Target MIB Module ........................... 33 4.1 The Management Target MIB Module ........................... 28
4.1.1 Tag Lists ................................................ 34 4.1.1 Tag Lists ................................................ 29
4.1.2 Definitions .............................................. 34 4.1.2 Definitions .............................................. 30
4.2 The Notification MIB Module ................................ 49 4.2 The Notification MIB Module ................................ 43
4.2.1 Definitions .............................................. 49 4.2.1 Definitions .............................................. 43
4.3 The Proxy MIB Module ....................................... 62 4.3 The Proxy MIB Module ....................................... 55
4.3.1 Definitions .............................................. 62 4.3.1 Definitions .............................................. 55
5 Identification of Management Targets in Notification Origi- 5 Identification of Management Targets in Notification
nators .................................................... 69 Originators ............................................... 61
6 Notification Filtering ....................................... 70 6 Notification Filtering ....................................... 62
7 Management Target Translation in Proxy Forwarder Applica- 7 Management Target Translation in Proxy Forwarder Applica-
tions ..................................................... 72 tions ..................................................... 63
7.1 Management Target Translation for Request Forwarding ....... 72 7.1 Management Target Translation for Request Forwarding ....... 63
7.2 Management Target Translation for Notification Forwarding 7.2 Management Target Translation for Notification Forwarding
........................................................... 73 ........................................................... 64
8 Intellectual Property ........................................ 74 8 Intellectual Property ........................................ 65
9 Acknowledgments .............................................. 74 9 Acknowledgments .............................................. 66
10 Security Considerations ..................................... 76 10 Security Considerations ..................................... 67
11 References .................................................. 77 11 References .................................................. 67
12 Editor's Address ............................................ 79 12 Editors' Addresses........................................... 69
A. Trap Configuration Example .................................. 80 A. Trap Configuration Example .................................. 70
B. Full Copyright Statement .................................... 82 B. Full Copyright Statement .................................... 72
1. Overview 1. Overview
This document describes five types of SNMP applications: This document describes five types of SNMP applications:
- Applications which initiate SNMP Read-Class, and/or Write- - Applications which initiate SNMP Read-Class, and/or Write-Class
Class requests, called 'command generators.' requests, called 'command generators.'
- Applications which respond to SNMP Read-Class, and/or Write-Class
- Applications which respond to SNMP Read-Class, and/or Write- requests, called 'command responders.'
Class requests, called 'command responders.' - Applications which generate SNMP Notification-Class PDUs, called
'notification originators.'
- Applications which generate SNMP Notification-Class PDUs, - Applications which receive SNMP Notification-Class PDUs, called
called 'notification originators.' 'notification receivers.'
- Applications which forward SNMP messages, called 'proxy
- Applications which receive SNMP Notification-Class PDUs, forwarders.'
called 'notification receivers.'
- Applications which forward SNMP messages, called 'proxy
forwarders.'
Note that there are no restrictions on which types of applications Note that there are no restrictions on which types of applications
may be associated with a particular SNMP engine. For example, a may be associated with a particular SNMP engine. For example, a
single SNMP engine may, in fact, be associated with both command single SNMP engine may, in fact, be associated with both command
generator and command responder applications. generator and command responder applications.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119]. document are to be interpreted as described in [RFC2119].
skipping to change at page 5, line 34 skipping to change at page 4, line 16
A proxy forwarder application forwards SNMP messages. Note that A proxy forwarder application forwards SNMP messages. Note that
implementation of a proxy forwarder application is optional. The implementation of a proxy forwarder application is optional. The
sections describing proxy (4.5, 5.3, and 8) may be skipped for sections describing proxy (4.5, 5.3, and 8) may be skipped for
implementations that do not include a proxy forwarder application. implementations that do not include a proxy forwarder application.
The term "proxy" has historically been used very loosely, with The term "proxy" has historically been used very loosely, with
multiple different meanings. These different meanings include (among multiple different meanings. These different meanings include (among
others): others):
(1) the forwarding of SNMP requests to other SNMP entities without (1) the forwarding of SNMP requests to other SNMP entities without
regard for what managed object types are being accessed; for regard for what managed object types are being accessed; for
example, in order to forward an SNMP request from one transport example, in order to forward an SNMP request from one transport
domain to another, or to translate SNMP requests of one version domain to another, or to translate SNMP requests of one version
into SNMP requests of another version; into SNMP requests of another version;
(2) the translation of SNMP requests into operations of some non-SNMP (2) the translation of SNMP requests into operations of some non-
management protocol; and SNMP management protocol; and
(3) support for aggregated managed objects where the value of one (3) support for aggregated managed objects where the value of one
managed object instance depends upon the values of multiple other managed object instance depends upon the values of multiple
(remote) items of management information. other (remote) items of management information.
Each of these scenarios can be advantageous; for example, support for Each of these scenarios can be advantageous; for example, support for
aggregation of management information can significantly reduce the aggregation of management information can significantly reduce the
bandwidth requirements of large-scale management activities. bandwidth requirements of large-scale management activities.
However, using a single term to cover multiple different scenarios However, using a single term to cover multiple different scenarios
causes confusion. causes confusion.
To avoid such confusion, this document uses the term "proxy" with a To avoid such confusion, this document uses the term "proxy" with a
much more tightly defined meaning. The term "proxy" is used in this much more tightly defined meaning. The term "proxy" is used in this
document to refer to a proxy forwarder application which forwards document to refer to a proxy forwarder application which forwards
either SNMP messages without regard for what managed objects are either SNMP messages without regard for what managed objects are
contained within those messages. This definition is most closely contained within those messages. This definition is most closely
related to the first definition above. Note, however, that in the related to the first definition above. Note, however, that in the
SNMP architecture [SNMP-ARCH], a proxy forwarder is actually an SNMP architecture [RFC2571], a proxy forwarder is actually an
application, and need not be associated with what is traditionally application, and need not be associated with what is traditionally
thought of as an SNMP agent. thought of as an SNMP agent.
Specifically, the distinction between a traditional SNMP agent and a Specifically, the distinction between a traditional SNMP agent and a
proxy forwarder application is simple: proxy forwarder application is simple:
- a proxy forwarder application forwards SNMP messages to other - a proxy forwarder application forwards SNMP messages to other
SNMP engines according to the context, and irrespective of the SNMP engines according to the context, and irrespective of the
specific managed object types being accessed, and forwards the specific managed object types being accessed, and forwards the
response to such previously forwarded messages back to the response to such previously forwarded messages back to the SNMP
SNMP engine from which the original message was received; engine from which the original message was received;
- in contrast, the command responder application that is part of - in contrast, the command responder application that is part of
what is traditionally thought of as an SNMP agent, and which what is traditionally thought of as an SNMP agent, and which
processes SNMP requests according to the (names of the) processes SNMP requests according to the (names of the)
individual managed object types and instances being accessed, individual managed object types and instances being accessed, is
is NOT a proxy forwarder application from the perspective of NOT a proxy forwarder application from the perspective of this
this document. document.
Thus, when a proxy forwarder application forwards a request or Thus, when a proxy forwarder application forwards a request or
notification for a particular contextEngineID / contextName pair, not notification for a particular contextEngineID / contextName pair, not
only is the information on how to forward the request specifically only is the information on how to forward the request specifically
associated with that context, but the proxy forwarder application has associated with that context, but the proxy forwarder application has
no need of a detailed definition of a MIB view (since the proxy no need of a detailed definition of a MIB view (since the proxy
forwarder application forwards the request irrespective of the forwarder application forwards the request irrespective of the
managed object types). managed object types).
In contrast, a command responder application must have the detailed In contrast, a command responder application must have the detailed
skipping to change at page 7, line 14 skipping to change at page 5, line 46
target to which the Notification-Class message was forwarded, rather target to which the Notification-Class message was forwarded, rather
than generating a response immediately when the Notification-Class than generating a response immediately when the Notification-Class
message is received. message is received.
2. Management Targets 2. Management Targets
Some types of applications (notification generators and proxy Some types of applications (notification generators and proxy
forwarders in particular) require a mechanism for determining where forwarders in particular) require a mechanism for determining where
and how to send generated messages. This document provides a and how to send generated messages. This document provides a
mechanism and MIB module for this purpose. The set of information mechanism and MIB module for this purpose. The set of information
that describes where and how to send a message is called a that describes where and how to send a message is called a '
'Management Target', and consists of two kinds of information: Management Target', and consists of two kinds of information:
- Destination information, consisting of a transport domain and - Destination information, consisting of a transport domain and a
a transport address. This is also termed a transport transport address. This is also termed a transport endpoint.
endpoint.
- SNMP parameters, consisting of message processing model, - SNMP parameters, consisting of message processing model,
security model, security level, and security name information. security model, security level, and security name information.
The SNMP-TARGET-MIB module described later in this document contains The SNMP-TARGET-MIB module described later in this document contains
one table for each of these types of information. There can be a one table for each of these types of information. There can be a
many-to-many relationship in the MIB between these two types of many-to-many relationship in the MIB between these two types of
information. That is, there may be multiple transport endpoints information. That is, there may be multiple transport endpoints
associated with a particular set of SNMP parameters, or a particular associated with a particular set of SNMP parameters, or a particular
transport endpoint may be associated with several sets of SNMP transport endpoint may be associated with several sets of SNMP
parameters. parameters.
3. Elements Of Procedure 3. Elements Of Procedure
The following sections describe the procedures followed by each type The following sections describe the procedures followed by each type
of application when generating messages for transmission or when of application when generating messages for transmission or when
processing received messages. Applications communicate with the processing received messages. Applications communicate with the
Dispatcher using the abstract service interfaces defined in [SNMP- Dispatcher using the abstract service interfaces defined in
ARCH]. [RFC2571].
3.1. Command Generator Applications 3.1. Command Generator Applications
A command generator initiates an SNMP request by calling the A command generator initiates an SNMP request by calling the
Dispatcher using the following abstract service interface: Dispatcher using the following abstract service interface:
statusInformation = -- sendPduHandle if success statusInformation = -- sendPduHandle if success
-- errorIndication if failure -- errorIndication if failure
sendPdu( sendPdu(
IN transportDomain -- transport domain to be used IN transportDomain -- transport domain to be used
IN transportAddress -- destination network address IN transportAddress -- destination network address
IN messageProcessingModel -- typically, SNMP version IN messageProcessingModel -- typically, SNMP version
IN securityModel -- Security Model to use IN securityModel -- Security Model to use
IN securityName -- on behalf of this principal IN securityName -- on behalf of this principal
IN securityLevel -- Level of Security requested IN securityLevel -- Level of Security requested
IN contextEngineID -- data from/at this entity IN contextEngineID -- data from/at this entity
IN contextName -- data from/in this context IN contextName -- data from/in this context
IN pduVersion -- the version of the PDU IN pduVersion -- the version of the PDU
IN PDU -- SNMP Protocol Data Unit IN PDU -- SNMP Protocol Data Unit
skipping to change at page 8, line 19 skipping to change at page 6, line 48
IN securityLevel -- Level of Security requested IN securityLevel -- Level of Security requested
IN contextEngineID -- data from/at this entity IN contextEngineID -- data from/at this entity
IN contextName -- data from/in this context IN contextName -- data from/in this context
IN pduVersion -- the version of the PDU IN pduVersion -- the version of the PDU
IN PDU -- SNMP Protocol Data Unit IN PDU -- SNMP Protocol Data Unit
IN expectResponse -- TRUE or FALSE IN expectResponse -- TRUE or FALSE
) )
Where: Where:
- The transportDomain is that of the destination of the message. - The transportDomain is that of the destination of the message.
- The transportAddress is that of the destination of the - The transportAddress is that of the destination of the message.
message.
- The messageProcessingModel indicates which Message Processing - The messageProcessingModel indicates which Message Processing
Model the application wishes to use. Model the application wishes to use.
- The securityModel is the security model that the application - The securityModel is the security model that the application
wishes to use. wishes to use.
- The securityName is the security model independent name for - The securityName is the security model independent name for the
the principal on whose behalf the application wishes the principal on whose behalf the application wishes the message is
message is to be generated. to be generated.
- The securityLevel is the security level that the application - The securityLevel is the security level that the application
wishes to use. wishes to use.
- The contextEngineID is provided by the command generator if it - The contextEngineID is provided by the command generator if it
wishes to explicitly specify the location of the management wishes to explicitly specify the location of the management
information it is requesting. information it is requesting.
- The contextName is provided by the command generator if it - The contextName is provided by the command generator if it
wishes to explicitly specify the local context name for the wishes to explicitly specify the local context name for the
management information it is requesting. management information it is requesting.
- The pduVersion indicates the version of the PDU to be sent. - The pduVersion indicates the version of the PDU to be sent.
- The PDU is a value constructed by the command generator - The PDU is a value constructed by the command generator
containing the management operation that the command generator containing the management operation that the command generator
wishes to perform. wishes to perform.
- The expectResponse argument indicates that a response is - The expectResponse argument indicates that a response is
expected. expected.
The result of the sendPdu interface indicates whether the PDU was The result of the sendPdu interface indicates whether the PDU was
successfully sent. If it was successfully sent, the returned value successfully sent. If it was successfully sent, the returned value
will be a sendPduHandle. The command generator should store the will be a sendPduHandle. The command generator should store the
sendPduHandle so that it can correlate a response to the original sendPduHandle so that it can correlate a response to the original
request. request.
The Dispatcher is responsible for delivering the response to a The Dispatcher is responsible for delivering the response to a
particular request to the correct command generator application. The particular request to the correct command generator application. The
abstract service interface used is: abstract service interface used is:
skipping to change at page 9, line 33 skipping to change at page 8, line 11
IN contextEngineID -- data from/at this SNMP entity IN contextEngineID -- data from/at this SNMP entity
IN contextName -- data from/in this context IN contextName -- data from/in this context
IN pduVersion -- the version of the PDU IN pduVersion -- the version of the PDU
IN PDU -- SNMP Protocol Data Unit IN PDU -- SNMP Protocol Data Unit
IN statusInformation -- success or errorIndication IN statusInformation -- success or errorIndication
IN sendPduHandle -- handle from sendPdu IN sendPduHandle -- handle from sendPdu
) )
Where: Where:
- The messageProcessingModel is the value from the received - The messageProcessingModel is the value from the received
response. response.
- The securityModel is the value from the received response. - The securityModel is the value from the received response.
- The securityName is the value from the received response. - The securityName is the value from the received response.
- The securityLevel is the value from the received response. - The securityLevel is the value from the received response.
- The contextEngineID is the value from the received response. - The contextEngineID is the value from the received response.
- The contextName is the value from the received response. - The contextName is the value from the received response.
- The pduVersion indicates the version of the PDU in the - The pduVersion indicates the version of the PDU in the received
received response. response.
- The PDU is the value from the received response. - The PDU is the value from the received response.
- The statusInformation indicates success or failure in - The statusInformation indicates success or failure in receiving
receiving the response. the response.
- The sendPduHandle is the value returned by the sendPdu call - The sendPduHandle is the value returned by the sendPdu call
which generated the original request to which this is a which generated the original request to which this is a
response. response.
The procedure when a command generator receives a message is as The procedure when a command generator receives a message is as
follows: follows:
(1) If the received values of messageProcessingModel, securityModel, (1) If the received values of messageProcessingModel, securityModel,
securityName, contextEngineID, contextName, and pduVersion are not securityName, contextEngineID, contextName, and pduVersion are
all equal to the values used in the original request, the response not all equal to the values used in the original request, the
is discarded. response is discarded.
(2) The operation type, request-id, error-status, error-index, and (2) The operation type, request-id, error-status, error-index, and
variable-bindings are extracted from the PDU and saved. If the variable-bindings are extracted from the PDU and saved. If the
request-id is not equal to the value used in the original request, request-id is not equal to the value used in the original
the response is discarded. request, the response is discarded.
(3) At this point, it is up to the application to take an appropriate (3) At this point, it is up to the application to take an
action. The specific action is implementation dependent. If the appropriate action. The specific action is implementation
statusInformation indicates that the request failed, an appropriate dependent. If the statusInformation indicates that the request
action might be to attempt to transmit the request again, or to failed, an appropriate action might be to attempt to transmit
notify the person operating the application that a failure the request again, or to notify the person operating the
occurred. application that a failure occurred.
3.2. Command Responder Applications 3.2. Command Responder Applications
Before a command responder application can process messages, it must Before a command responder application can process messages, it must
first associate itself with an SNMP engine. The abstract service first associate itself with an SNMP engine. The abstract service
interface used for this purpose is: interface used for this purpose is:
statusInformation = -- success or errorIndication statusInformation = -- success or errorIndication
registerContextEngineID( registerContextEngineID(
IN contextEngineID -- take responsibility for this one IN contextEngineID -- take responsibility for this one
IN pduType -- the pduType(s) to be registered IN pduType -- the pduType(s) to be registered
) )
Where: Where:
- The statusInformation indicates success or failure of the - The statusInformation indicates success or failure of the
registration attempt. registration attempt.
- The contextEngineID is equal to the snmpEngineID of the SNMP - The contextEngineID is equal to the snmpEngineID of the SNMP
engine with which the command responder is registering. engine with which the command responder is registering.
- The pduType indicates a Read-Class and/or Write-Class PDU. - The pduType indicates a Read-Class and/or Write-Class PDU.
Note that if another command responder application is already Note that if another command responder application is already
registered with an SNMP engine, any further attempts to register with registered with an SNMP engine, any further attempts to register with
the same contextEngineID and pduType will be denied. This implies the same contextEngineID and pduType will be denied. This implies
that separate command responder applications could register that separate command responder applications could register
separately for the various pdu types. However, in practice this is separately for the various pdu types. However, in practice this is
undesirable, and only a single command responder application should undesirable, and only a single command responder application should
be registered with an SNMP engine at any given time. be registered with an SNMP engine at any given time.
A command responder application can disassociate with an SNMP engine A command responder application can disassociate with an SNMP engine
using the following abstract service interface: using the following abstract service interface:
unregisterContextEngineID( unregisterContextEngineID(
IN contextEngineID -- give up responsibility for this one IN contextEngineID -- give up responsibility for this one
IN pduType -- the pduType(s) to be unregistered IN pduType -- the pduType(s) to be unregistered
) )
Where: Where:
- The contextEngineID is equal to the snmpEngineID of the SNMP - The contextEngineID is equal to the snmpEngineID of the SNMP
engine with which the command responder is cancelling the engine with which the command responder is cancelling the
registration. registration.
- The pduType indicates a Read-Class and/or Write-Class PDU. - The pduType indicates a Read-Class and/or Write-Class PDU.
Once the command responder has registered with the SNMP engine, it Once the command responder has registered with the SNMP engine, it
waits to receive SNMP messages. The abstract service interface used waits to receive SNMP messages. The abstract service interface used
for receiving messages is: for receiving messages is:
processPdu( -- process Request/Notification PDU processPdu( -- process Request/Notification PDU
IN messageProcessingModel -- typically, SNMP version IN messageProcessingModel -- typically, SNMP version
IN securityModel -- Security Model in use IN securityModel -- Security Model in use
IN securityName -- on behalf of this principal IN securityName -- on behalf of this principal
IN securityLevel -- Level of Security IN securityLevel -- Level of Security
IN contextEngineID -- data from/at this SNMP entity IN contextEngineID -- data from/at this SNMP entity
IN contextName -- data from/in this context IN contextName -- data from/in this context
IN pduVersion -- the version of the PDU IN pduVersion -- the version of the PDU
IN PDU -- SNMP Protocol Data Unit IN PDU -- SNMP Protocol Data Unit
IN maxSizeResponseScopedPDU -- maximum size of the Response PDU IN maxSizeResponseScopedPDU -- maximum size of the Response PDU
IN stateReference -- reference to state information IN stateReference -- reference to state information
) -- needed when sending a response ) -- needed when sending a response
Where: Where:
- The messageProcessingModel indicates which Message Processing - The messageProcessingModel indicates which Message Processing
Model received and processed the message. Model received and processed the message.
- The securityModel is the value from the received message. - The securityModel is the value from the received message.
- The securityName is the value from the received message. - The securityName is the value from the received message.
- The securityLevel is the value from the received message. - The securityLevel is the value from the received message.
- The contextEngineID is the value from the received message. - The contextEngineID is the value from the received message.
- The contextName is the value from the received message. - The contextName is the value from the received message.
- The pduVersion indicates the version of the PDU in the - The pduVersion indicates the version of the PDU in the received
received message. message.
- The PDU is the value from the received message. - The PDU is the value from the received message.
- The maxSizeResponseScopedPDU is the maximum allowable size of - The maxSizeResponseScopedPDU is the maximum allowable size of a
a ScopedPDU containing a Response PDU (based on the maximum ScopedPDU containing a Response PDU (based on the maximum
message size that the originator of the message can accept). message size that the originator of the message can accept).
- The stateReference is a value which references cached - The stateReference is a value which references cached
information about each received request message. This value information about each received request message. This value
must be returned to the Dispatcher in order to generate a must be returned to the Dispatcher in order to generate a
response. response.
The procedure when a message is received is as follows. The procedure when a message is received is as follows.
(1) The operation type is determined from the ASN.1 tag value (1) The operation type is determined from the ASN.1 tag value
associated with the PDU parameter. The operation type should associated with the PDU parameter. The operation type should
always be one of the types previously registered by the always be one of the types previously registered by the
application. application.
(2) The request-id is extracted from the PDU and saved. (2) The request-id is extracted from the PDU and saved.
(3) Any PDU type specific parameters are extracted from the PDU and (3) Any PDU type specific parameters are extracted from the PDU and
saved (for example, if the PDU type is an SNMPv2 GetBulk PDU, the saved (for example, if the PDU type is an SNMPv2 GetBulk PDU,
non-repeaters and max-repetitions values are extracted). the non-repeaters and max-repetitions values are extracted).
(4) The variable-bindings are extracted from the PDU and saved. (4) The variable-bindings are extracted from the PDU and saved.
(5) The management operation represented by the PDU type is performed (5) The management operation represented by the PDU type is
with respect to the relevant MIB view within the context named by performed with respect to the relevant MIB view within the
the contextName (for an SNMPv2 PDU type, the operation is performed context named by the contextName (for an SNMPv2 PDU type, the
according to the procedures set forth in [RFC1905]). The relevant operation is performed according to the procedures set forth in
MIB view is determined by the securityLevel, securityModel, [RFC1905]). The relevant MIB view is determined by the
contextName, securityName, and the class of the PDU type. To securityLevel, securityModel, contextName, securityName, and the
determine whether a particular object instance is within the class of the PDU type. To determine whether a particular object
relevant MIB view, the following abstract service interface is instance is within the relevant MIB view, the following abstract
called: service interface is called:
statusInformation = -- success or errorIndication statusInformation = -- success or errorIndication
isAccessAllowed( isAccessAllowed(
IN securityModel -- Security Model in use IN securityModel -- Security Model in use
IN securityName -- principal who wants to access IN securityName -- principal who wants to access
IN securityLevel -- Level of Security IN securityLevel -- Level of Security
IN viewType -- read, write, or notify view IN viewType -- read, write, or notify view
IN contextName -- context containing variableName IN contextName -- context containing variableName
IN variableName -- OID for the managed object IN variableName -- OID for the managed object
) )
Where: Where:
- The securityModel is the value from the received message. - The securityModel is the value from the received message.
- The securityName is the value from the received message. - The securityName is the value from the received message.
- The securityLevel is the value from the received message. - The securityLevel is the value from the received message.
- The viewType indicates whether the PDU type is a Read-Class or - The viewType indicates whether the PDU type is a Read-Class or
Write-Class operation. Write-Class operation.
- The contextName is the value from the received message. - The contextName is the value from the received message.
- The variableName is the object instance of the variable for - The variableName is the object instance of the variable for
which access rights are to be checked. which access rights are to be checked.
Normally, the result of the management operation will be a new PDU Normally, the result of the management operation will be a new PDU
value, and processing will continue in step (6) below. However, at value, and processing will continue in step (6) below. However, at
any time during the processing of the management operation: any time during the processing of the management operation:
- If the isAccessAllowed ASI returns a noSuchView, - If the isAccessAllowed ASI returns a noSuchView, noAccessEntry,
noAccessEntry, or noGroupName error, processing of the or noGroupName error, processing of the management operation is
management operation is halted, a PDU value is constructed halted, a PDU value is constructed using the values from the
using the values from the originally received PDU, but originally received PDU, but replacing the error_status with an
replacing the error_status with an authorizationError code, authorizationError code, and error_index value of 0, and control
and error_index value of 0, and control is passed to step (6) is passed to step (6) below.
below.
- If the isAccessAllowed ASI returns an otherError, processing - If the isAccessAllowed ASI returns an otherError, processing of
of the management operation is halted, a different PDU value the management operation is halted, a different PDU value is
is constructed using the values from the originally received constructed using the values from the originally received PDU,
PDU, but replacing the error_status with a genError code, and but replacing the error_status with a genError code, and control
control is passed to step (6) below. is passed to step (6) below.
- If the isAccessAllowed ASI returns a noSuchContext error, - If the isAccessAllowed ASI returns a noSuchContext error,
processing of the management operation is halted, no result processing of the management operation is halted, no result PDU
PDU is generated, the snmpUnknownContexts counter is is generated, the snmpUnknownContexts counter is incremented,
incremented, and control is passed to step (6) below. and control is passed to step (6) below.
- If the context named by the contextName parameter is - If the context named by the contextName parameter is
unavailable, processing of the management operation is halted, unavailable, processing of the management operation is halted,
no result PDU is generated, the snmpUnavailableContexts no result PDU is generated, the snmpUnavailableContexts counter
counter is incremented, and control is passed to step (6) is incremented, and control is passed to step (6) below.
below.
(6) The Dispatcher is called to generate a response or report message. (6) The Dispatcher is called to generate a response or report
The abstract service interface is: message. The abstract service interface is:
returnResponsePdu( returnResponsePdu(
IN messageProcessingModel -- typically, SNMP version IN messageProcessingModel -- typically, SNMP version
IN securityModel -- Security Model in use IN securityModel -- Security Model in use
IN securityName -- on behalf of this principal IN securityName -- on behalf of this principal
IN securityLevel -- same as on incoming request IN securityLevel -- same as on incoming request
IN contextEngineID -- data from/at this SNMP entity IN contextEngineID -- data from/at this SNMP entity
IN contextName -- data from/in this context IN contextName -- data from/in this context
IN pduVersion -- the version of the PDU IN pduVersion -- the version of the PDU
IN PDU -- SNMP Protocol Data Unit IN PDU -- SNMP Protocol Data Unit
IN maxSizeResponseScopedPDU -- maximum size of the Response PDU IN maxSizeResponseScopedPDU -- maximum size of the Response PDU
IN stateReference -- reference to state information IN stateReference -- reference to state information
-- as presented with the request -- as presented with the request
IN statusInformation -- success or errorIndication IN statusInformation -- success or errorIndication
) -- error counter OID/value if error ) -- error counter OID/value if error
Where: Where:
- The messageProcessingModel is the value from the processPdu - The messageProcessingModel is the value from the processPdu
call. call.
- The securityModel is the value from the processPdu call. - The securityModel is the value from the processPdu call.
- The securityName is the value from the processPdu call. - The securityName is the value from the processPdu call.
- The securityLevel is the value from the processPdu call. - The securityLevel is the value from the processPdu call.
- The contextEngineID is the value from the processPdu call. - The contextEngineID is the value from the processPdu call.
- The contextName is the value from the processPdu call. - The contextName is the value from the processPdu call.
- The pduVersion indicates the version of the PDU to be - The pduVersion indicates the version of the PDU to be returned.
returned. If no result PDU was generated, the pduVersion is If no result PDU was generated, the pduVersion is an undefined
an undefined value. value.
- The PDU is the result generated in step (5) above. If no - The PDU is the result generated in step (5) above. If no result
result PDU was generated, the PDU is an undefined value. PDU was generated, the PDU is an undefined value.
- The maxSizeResponseScopedPDU is a local value indicating the - The maxSizeResponseScopedPDU is a local value indicating the
maximum size of a ScopedPDU that the application can accept. maximum size of a ScopedPDU that the application can accept.
- The stateReference is the value from the processPdu call. - The stateReference is the value from the processPdu call.
- The statusInformation either contains an indication that no - The statusInformation either contains an indication that no
error occurred and that a response should be generated, or error occurred and that a response should be generated, or
contains an indication that an error occurred along with the contains an indication that an error occurred along with the OID
OID and counter value of the appropriate error counter object. and counter value of the appropriate error counter object.
Note that a command responder application should always call the Note that a command responder application should always call the
returnResponsePdu abstract service interface, even in the event of an returnResponsePdu abstract service interface, even in the event of an
error such as a resource allocation error. In the event of such an error such as a resource allocation error. In the event of such an
error, the PDU value passed to returnResponsePdu should contain error, the PDU value passed to returnResponsePdu should contain
appropriate values for errorStatus and errorIndex. appropriate values for errorStatus and errorIndex.
Note that the text above describes situations where the Note that the text above describes situations where the
snmpUnknownContexts counter is incremented, and where the snmpUnknownContexts counter is incremented, and where the
snmpUnavailableContexts counter is incremented. The difference snmpUnavailableContexts counter is incremented. The difference
skipping to change at page 17, line 35 skipping to change at page 14, line 38
application must also determine, for each management target, what application must also determine, for each management target, what
specific PDU type the notification message should contain, and if it specific PDU type the notification message should contain, and if it
is to contain a Confirmed-Class PDU, the number of retries and is to contain a Confirmed-Class PDU, the number of retries and
retransmission algorithm. retransmission algorithm.
The mechanism by which a notification originator determines this The mechanism by which a notification originator determines this
information is implementation dependent. Once the application has information is implementation dependent. Once the application has
determined this information, the following procedure is performed for determined this information, the following procedure is performed for
each management target: each management target:
(1) Any appropriate filtering mechanisms are applied to determine (1) Any appropriate filtering mechanisms are applied to determine
whether the notification should be sent to the management target. whether the notification should be sent to the management
If such filtering mechanisms determine that the notification should target. If such filtering mechanisms determine that the
not be sent, processing continues with the next management target. notification should not be sent, processing continues with the
Otherwise, next management target. Otherwise,
(2) The appropriate set of variable-bindings is retrieved from local (2) The appropriate set of variable-bindings is retrieved from local
MIB instrumentation within the relevant MIB view. The relevant MIB MIB instrumentation within the relevant MIB view. The relevant
view is determined by the securityLevel, securityModel, MIB view is determined by the securityLevel, securityModel,
contextName, and securityName of the management target. To contextName, and securityName of the management target. To
determine whether a particular object instance is within the determine whether a particular object instance is within the
relevant MIB view, the isAccessAllowed abstract service interface relevant MIB view, the isAccessAllowed abstract service
is used, in the same manner as described in the preceding section. interface is used, in the same manner as described in the
If the statusInformation returned by isAccessAllowed does not preceding section. If the statusInformation returned by
indicate accessAllowed, the notification is not sent to the isAccessAllowed does not indicate accessAllowed, the
management target. notification is not sent to the management target.
(3) The NOTIFICATION-TYPE OBJECT IDENTIFIER of the notification (this (3) The NOTIFICATION-TYPE OBJECT IDENTIFIER of the notification
is the value of the element of the variable bindings whose name is (this is the value of the element of the variable bindings whose
snmpTrapOID.0, i.e., the second variable binding) is checked using name is snmpTrapOID.0, i.e., the second variable binding) is
the isAccessAllowed abstract service interface, using the same checked using the isAccessAllowed abstract service interface,
parameters used in the preceding step. If the statusInformation using the same parameters used in the preceding step. If the
returned by isAccessAllowed does not indicate accessAllowed, the statusInformation returned by isAccessAllowed does not indicate
notification is not sent to the management target. accessAllowed, the notification is not sent to the management
target.
(4) A PDU is constructed using a locally unique request-id value, a PDU (4) A PDU is constructed using a locally unique request-id value, a
type as determined by the implementation, an error-status and PDU type as determined by the implementation, an error-status
error-index value of 0, and the variable-bindings supplied and error-index value of 0, and the variable-bindings supplied
previously in step (2). previously in step (2).
(5) If the notification contains an Unconfirmed-Class PDU, the (5) If the notification contains an Unconfirmed-Class PDU, the
Dispatcher is called using the following abstract service Dispatcher is called using the following abstract service
interface: interface:
statusInformation = -- sendPduHandle if success statusInformation = -- sendPduHandle if success
-- errorIndication if failure -- errorIndication if failure
sendPdu( sendPdu(
IN transportDomain -- transport domain to be used IN transportDomain -- transport domain to be used
IN transportAddress -- destination network address IN transportAddress -- destination network address
IN messageProcessingModel -- typically, SNMP version IN messageProcessingModel -- typically, SNMP version
IN securityModel -- Security Model to use IN securityModel -- Security Model to use
IN securityName -- on behalf of this principal IN securityName -- on behalf of this principal
IN securityLevel -- Level of Security requested IN securityLevel -- Level of Security requested
IN contextEngineID -- data from/at this entity IN contextEngineID -- data from/at this entity
IN contextName -- data from/in this context IN contextName -- data from/in this context
IN pduVersion -- the version of the PDU IN pduVersion -- the version of the PDU
IN PDU -- SNMP Protocol Data Unit IN PDU -- SNMP Protocol Data Unit
IN expectResponse -- TRUE or FALSE IN expectResponse -- TRUE or FALSE
) )
Where: Where:
- The transportDomain is that of the management target. - The transportDomain is that of the management target.
- The transportAddress is that of the management target. - The transportAddress is that of the management target.
- The messageProcessingModel is that of the management target. - The messageProcessingModel is that of the management target.
- The securityModel is that of the management target. - The securityModel is that of the management target.
- The securityName is that of the management target. - The securityName is that of the management target.
- The securityLevel is that of the management target. - The securityLevel is that of the management target.
- The contextEngineID is the value originally determined for the - The contextEngineID is the value originally determined for the
notification. notification.
- The contextName is the value originally determined for the - The contextName is the value originally determined for the
notification. notification.
- The pduVersion is the version of the PDU to be sent. - The pduVersion is the version of the PDU to be sent.
- The PDU is the value constructed in step (3) above. - The PDU is the value constructed in step (3) above.
- The expectResponse argument indicates that no response is - The expectResponse argument indicates that no response is
expected. expected.
Otherwise, Otherwise,
(6) If the notification contains a Confirmed-Class PDU, then: (6) If the notification contains a Confirmed-Class PDU, then:
a) The Dispatcher is called using the sendPdu abstract service a) The Dispatcher is called using the sendPdu abstract service
interface as described in step (4) above, except that the interface as described in step (4) above, except that the
expectResponse argument indicates that a response is expected. expectResponse argument indicates that a response is
expected.
b) The application caches information about the management b) The application caches information about the management
target. target.
c) If a response is received within an appropriate time interval c) If a response is received within an appropriate time
from the transport endpoint of the management target, the interval from the transport endpoint of the management
notification is considered acknowledged and the cached target, the notification is considered acknowledged and the
information is deleted. Otherwise, cached information is deleted. Otherwise,
d) If a response is not received within an appropriate time d) If a response is not received within an appropriate time
period, or if a report indication is received, information period, or if a report indication is received, information
about the management target is retrieved from the cache, and about the management target is retrieved from the cache, and
steps a) through d) are repeated. The number of times these steps a) through d) are repeated. The number of times these
steps are repeated is equal to the previously determined retry steps are repeated is equal to the previously determined
count. If this retry count is exceeded, the acknowledgement retry count. If this retry count is exceeded, the
of the notification is considered to have failed, and acknowledgement of the notification is considered to have
processing of the notification for this management target is failed, and processing of the notification for this
halted. Note that some report indications might be considered management target is halted. Note that some report
a failure. Such report indications should be interpreted to indications might be considered a failure. Such report
mean that the acknowledgement of the notification has failed. indications should be interpreted to mean that the
acknowledgement of the notification has failed.
Responses to Confirmed-Class PDU notifications will be received via Responses to Confirmed-Class PDU notifications will be received via
the processResponsePdu abstract service interface. the processResponsePdu abstract service interface.
To summarize, the steps that a notification originator follows when To summarize, the steps that a notification originator follows when
determining where to send a notification are: determining where to send a notification are:
- Determine the targets to which the notification should be - Determine the targets to which the notification should be sent.
sent.
- Apply any required filtering to the list of targets. - Apply any required filtering to the list of targets.
- Determine which targets are authorized to receive the - Determine which targets are authorized to receive the
notification. notification.
3.4. Notification Receiver Applications 3.4. Notification Receiver Applications
Notification receiver applications receive SNMP Notification messages Notification receiver applications receive SNMP Notification messages
from the Dispatcher. Before any messages can be received, the from the Dispatcher. Before any messages can be received, the
notification receiver must register with the Dispatcher using the notification receiver must register with the Dispatcher using the
registerContextEngineID abstract service interface. The parameters registerContextEngineID abstract service interface. The parameters
used are: used are:
- The contextEngineID is an undefined 'wildcard' value. - The contextEngineID is an undefined 'wildcard' value.
Notifications are delivered to a registered notification Notifications are delivered to a registered notification
receiver regardless of the contextEngineID contained in the receiver regardless of the contextEngineID contained in the
notification message. notification message.
- The pduType indicates the type of notifications that the - The pduType indicates the type of notifications that the
application wishes to receive (for example, SNMPv2-Trap PDUs application wishes to receive (for example, SNMPv2-Trap PDUs or
or Inform PDUs). Inform PDUs).
Once the notification receiver has registered with the Dispatcher, Once the notification receiver has registered with the Dispatcher,
messages are received using the processPdu abstract service messages are received using the processPdu abstract service
interface. Parameters are: interface. Parameters are:
- The messageProcessingModel indicates which Message Processing - The messageProcessingModel indicates which Message Processing
Model received and processed the message. Model received and processed the message.
- The securityModel is the value from the received message. - The securityModel is the value from the received message.
- The securityName is the value from the received message. - The securityName is the value from the received message.
- The securityLevel is the value from the received message. - The securityLevel is the value from the received message.
- The contextEngineID is the value from the received message. - The contextEngineID is the value from the received message.
- The contextName is the value from the received message. - The contextName is the value from the received message.
- The pduVersion indicates the version of the PDU in the - The pduVersion indicates the version of the PDU in the received
received message. message.
- The PDU is the value from the received message. - The PDU is the value from the received message.
- The maxSizeResponseScopedPDU is the maximum allowable size of - The maxSizeResponseScopedPDU is the maximum allowable size of a
a ScopedPDU containing a Response PDU (based on the maximum ScopedPDU containing a Response PDU (based on the maximum
message size that the originator of the message can accept). message size that the originator of the message can accept).
- If the message contains an Unconfirmed-Class PDU, the - If the message contains an Unconfirmed-Class PDU, the
stateReference is undefined and unused. Otherwise, the stateReference is undefined and unused. Otherwise, the
stateReference is a value which references cached information stateReference is a value which references cached information
about the notification. This value must be returned to the about the notification. This value must be returned to the
Dispatcher in order to generate a response. Dispatcher in order to generate a response.
When an Unconfirmed-Class PDU is delivered to a notification receiver When an Unconfirmed-Class PDU is delivered to a notification receiver
application, it first extracts the SNMP operation type, request-id, application, it first extracts the SNMP operation type, request-id,
error-status, error-index, and variable-bindings from the PDU. After error-status, error-index, and variable-bindings from the PDU. After
this, processing depends on the particular implementation. this, processing depends on the particular implementation.
When a Confirmed-Class PDU is received, the notification receiver When a Confirmed-Class PDU is received, the notification receiver
application follows the following procedure: application follows the following procedure:
(1) The PDU type, request-id, error-status, error-index, and variable- (1) The PDU type, request-id, error-status, error-index, and
bindings are extracted from the PDU. variable-bindings are extracted from the PDU.
(2) A Response-Class PDU is constructed using the extracted request-id (2) A Response-Class PDU is constructed using the extracted
and variable-bindings, and with error-status and error-index both request-id and variable-bindings, and with error-status and
set to 0. error-index both set to 0.
(3) The Dispatcher is called to generate a response message using the (3) The Dispatcher is called to generate a response message using
returnResponsePdu abstract service interface. Parameters are: the returnResponsePdu abstract service interface. Parameters
are:
- The messageProcessingModel is the value from the processPdu - The messageProcessingModel is the value from the processPdu
call. call.
- The securityModel is the value from the processPdu call. - The securityModel is the value from the processPdu call.
- The securityName is the value from the processPdu call. - The securityName is the value from the processPdu call.
- The securityLevel is the value from the processPdu call. - The securityLevel is the value from the processPdu call.
- The contextEngineID is the value from the processPdu call. - The contextEngineID is the value from the processPdu call.
- The contextName is the value from the processPdu call. - The contextName is the value from the processPdu call.
- The pduVersion indicates the version of the PDU to be - The pduVersion indicates the version of the PDU to be returned.
returned.
- The PDU is the result generated in step (2) above. - The PDU is the result generated in step (2) above.
- The maxSizeResponseScopedPDU is a local value indicating the - The maxSizeResponseScopedPDU is a local value indicating the
maximum size of a ScopedPDU that the application can accept. maximum size of a ScopedPDU that the application can accept.
- The stateReference is the value from the processPdu call. - The stateReference is the value from the processPdu call.
- The statusInformation indicates that no error occurred and - The statusInformation indicates that no error occurred and that
that a response should be generated. a response should be generated.
3.5. Proxy Forwarder Applications 3.5. Proxy Forwarder Applications
A proxy forwarder application deals with forwarding SNMP messages. A proxy forwarder application deals with forwarding SNMP messages.
There are four basic types of messages which a proxy forwarder There are four basic types of messages which a proxy forwarder
application may need to forward. These are grouped according to the application may need to forward. These are grouped according to the
class of PDU type contained in a message. The four basic types of class of PDU type contained in a message. The four basic types of
messages are: messages are:
- Those containing Read-Class or Write-Class PDU types (for - Those containing Read-Class or Write-Class PDU types (for
example, Get, GetNext, GetBulk, and Set PDU types). These example, Get, GetNext, GetBulk, and Set PDU types). These deal
deal with requesting or modifying information located within a with requesting or modifying information located within a
particular context. particular context.
- Those containing Notification-Class PDU types (for example, - Those containing Notification-Class PDU types (for example,
SNMPv2-Trap and Inform PDU types). These deal with SNMPv2-Trap and Inform PDU types). These deal with
notifications concerning information located within a notifications concerning information located within a particular
particular context. context.
- Those containing a Response-Class PDU type. Forwarding of - Those containing a Response-Class PDU type. Forwarding of
Response PDUs always occurs as a result of receiving a Response PDUs always occurs as a result of receiving a response
response to a previously forwarded message. to a previously forwarded message.
- Those containing Internal-Class PDU types (for example, a - Those containing Internal-Class PDU types (for example, a Report
Report PDU). Forwarding of Internal-Class PDU types always PDU). Forwarding of Internal-Class PDU types always occurs as a
occurs as a result of receiving an Internal-Class PDU in result of receiving an Internal-Class PDU in response to a
response to a previously forwarded message. previously forwarded message.
For the first type, the proxy forwarder's role is to deliver a For the first type, the proxy forwarder's role is to deliver a
request for management information to an SNMP engine which is request for management information to an SNMP engine which is
"closer" or "downstream in the path" to the SNMP engine which has "closer" or "downstream in the path" to the SNMP engine which has
access to that information, and to deliver the response containing access to that information, and to deliver the response containing
the information back to the SNMP engine from which the request was the information back to the SNMP engine from which the request was
received. The context information in a request is used to determine received. The context information in a request is used to determine
which SNMP engine has access to the requested information, and this which SNMP engine has access to the requested information, and this
is used to determine where and how to forward the request. is used to determine where and how to forward the request.
skipping to change at page 24, line 47 skipping to change at page 21, line 13
reflect its current configuration. reflect its current configuration.
A proxy forwarder application should never attempt to register a A proxy forwarder application should never attempt to register a
value of contextEngineID which is equal to the snmpEngineID of the value of contextEngineID which is equal to the snmpEngineID of the
SNMP engine to which the proxy forwarder is associated. SNMP engine to which the proxy forwarder is associated.
Once the proxy forwarder has registered for the appropriate Once the proxy forwarder has registered for the appropriate
contextEngineID values, it can start processing messages. The contextEngineID values, it can start processing messages. The
following procedure is used: following procedure is used:
(1) A message is received using the processPdu abstract service (1) A message is received using the processPdu abstract service
interface. The incoming management target information received interface. The incoming management target information received
from the processPdu interface is translated into outgoing from the processPdu interface is translated into outgoing
management target information. Note that this translation may vary management target information. Note that this translation may
for different values of contextEngineID and/or contextName. The vary for different values of contextEngineID and/or contextName.
translation should result in a single management target. The translation should result in a single management target.
(2) If appropriate outgoing management target information cannot be (2) If appropriate outgoing management target information cannot be
found, the proxy forwarder increments the snmpProxyDrops counter found, the proxy forwarder increments the snmpProxyDrops counter
[RFC1907], and then calls the Dispatcher using the [RFC1907], and then calls the Dispatcher using the
returnResponsePdu abstract service interface. Parameters are: returnResponsePdu abstract service interface. Parameters are:
- The messageProcessingModel is the value from the processPdu - The messageProcessingModel is the value from the processPdu
call. call.
- The securityModel is the value from the processPdu call. - The securityModel is the value from the processPdu call.
- The securityName is the value from the processPdu call. - The securityName is the value from the processPdu call.
- The securityLevel is the value from the processPdu call. - The securityLevel is the value from the processPdu call.
- The contextEngineID is the value from the processPdu call. - The contextEngineID is the value from the processPdu call.
- The contextName is the value from the processPdu call. - The contextName is the value from the processPdu call.
- The pduVersion is the value from the processPdu call. - The pduVersion is the value from the processPdu call.
- The PDU is an undefined value. - The PDU is an undefined value.
- The maxSizeResponseScopedPDU is a local value indicating the - The maxSizeResponseScopedPDU is a local value indicating the
maximum size of a ScopedPDU that the application can accept. maximum size of a ScopedPDU that the application can accept.
- The stateReference is the value from the processPdu call. - The stateReference is the value from the processPdu call.
- The statusInformation indicates that an error occurred and - The statusInformation indicates that an error occurred and
includes the OID and value of the snmpProxyDrops object. includes the OID and value of the snmpProxyDrops object.
Processing of the message stops at this point. Otherwise, Processing of the message stops at this point. Otherwise,
(3) A new PDU is constructed. A unique value of request-id should be (3) A new PDU is constructed. A unique value of request-id should
used in the new PDU (this value will enable a subsequent response be used in the new PDU (this value will enable a subsequent
message to be correlated with this request). The remainder of the response message to be correlated with this request). The
new PDU is identical to the received PDU, unless the incoming SNMP remainder of the new PDU is identical to the received PDU,
version and the outgoing SNMP version support different PDU unless the incoming SNMP version and the outgoing SNMP version
versions, in which case the proxy forwarder may need to perform a support different PDU versions, in which case the proxy
translation on the PDU (A method for performing such a translation forwarder may need to perform a translation on the PDU (A method
is described in [COEX].) for performing such a translation is described in [COEX].)
(4) The proxy forwarder calls the Dispatcher to generate the forwarded (4) The proxy forwarder calls the Dispatcher to generate the
message, using the sendPdu abstract service interface. The forwarded message, using the sendPdu abstract service interface.
parameters are: The parameters are:
- The transportDomain is that of the outgoing management target. - The transportDomain is that of the outgoing management target.
- The transportAddress is that of the outgoing management - The transportAddress is that of the outgoing management target.
target.
- The messageProcessingModel is that of the outgoing management - The messageProcessingModel is that of the outgoing management
target. target.
- The securityModel is that of the outgoing management target. - The securityModel is that of the outgoing management target.
- The securityName is that of the outgoing management target. - The securityName is that of the outgoing management target.
- The securityLevel is that of the outgoing management target. - The securityLevel is that of the outgoing management target.
- The contextEngineID is the value originally received. - The contextEngineID is the value originally received.
- The contextName is the value originally received. - The contextName is the value originally received.
- The pduVersion is the version of the PDU to be sent. - The pduVersion is the version of the PDU to be sent.
- The PDU is the value constructed in step (3) above. - The PDU is the value constructed in step (3) above.
- The expectResponse argument indicates that a response is - The expectResponse argument indicates that a response is
expected. If the sendPdu call is unsuccessful, the proxy expected. If the sendPdu call is unsuccessful, the proxy
forwarder performs the steps described in (2) above. forwarder performs the steps described in (2) above. Otherwise:
Otherwise:
(5) The proxy forwarder caches the following information in order to (5) The proxy forwarder caches the following information in order to
match an incoming response to the forwarded request: match an incoming response to the forwarded request:
- The sendPduHandle returned from the call to sendPdu, - The sendPduHandle returned from the call to sendPdu,
- The request-id from the received PDU. - The request-id from the received PDU.
- the contextEngineID, - the contextEngineID,
- the contextName, - the contextName,
- the stateReference,
- the stateReference, - the incoming management target information,
- the incoming management target information, - the outgoing management information,
- the outgoing management information,
- any other information needed to match an incoming response to - any other information needed to match an incoming response to
the forwarded request. the forwarded request.
If this information cannot be cached (possibly due to a lack of If this information cannot be cached (possibly due to a lack of
resources), the proxy forwarder performs the steps described in (2) resources), the proxy forwarder performs the steps described in
above. Otherwise: (2) above. Otherwise:
(6) Processing of the request stops until a response to the forwarded (6) Processing of the request stops until a response to the
request is received, or until an appropriate time interval has forwarded request is received, or until an appropriate time
expired. If this time interval expires before a response has been interval has expired. If this time interval expires before a
received, the cached information about this request is removed. response has been received, the cached information about this
request is removed.
3.5.1.2. Processing an Incoming Response 3.5.1.2. Processing an Incoming Response
A proxy forwarder follows the following procedure when an incoming A proxy forwarder follows the following procedure when an incoming
response is received: response is received:
(1) The incoming response is received using the processResponsePdu (1) The incoming response is received using the processResponsePdu
interface. The proxy forwarder uses the received parameters to interface. The proxy forwarder uses the received parameters to
locate an entry in its cache of pending forwarded requests. This locate an entry in its cache of pending forwarded requests.
is done by matching the received parameters with the cached values This is done by matching the received parameters with the cached
of sendPduHandle, contextEngineID, contextName, outgoing management values of sendPduHandle, contextEngineID, contextName, outgoing
target information, and the request-id contained in the received management target information, and the request-id contained in
PDU (the proxy forwarder must extract the request-id for this the received PDU (the proxy forwarder must extract the request-
purpose). If an appropriate cache entry cannot be found, id for this purpose). If an appropriate cache entry cannot be
processing of the response is halted. Otherwise: found, processing of the response is halted. Otherwise:
(2) The cache information is extracted, and removed from the cache. (2) The cache information is extracted, and removed from the cache.
(3) A new Response-Class PDU is constructed, using the request-id value (3) A new Response-Class PDU is constructed, using the request-id
from the original forwarded request (as extracted from the cache). value from the original forwarded request (as extracted from the
All other values are identical to those in the received Response- cache). All other values are identical to those in the received
Class PDU, unless the incoming SNMP version and the outgoing SNMP Response-Class PDU, unless the incoming SNMP version and the
version support different PDU versions, in which case the proxy outgoing SNMP version support different PDU versions, in which
forwarder may need to perform a translation on the PDU. (A method case the proxy forwarder may need to perform a translation on
for performing such a translation is described in [COEX].) the PDU. (A method for performing such a translation is
described in [COEX].)
(4) The proxy forwarder calls the Dispatcher using the (4) The proxy forwarder calls the Dispatcher using the
returnResponsePdu abstract service interface. Parameters are: returnResponsePdu abstract service interface. Parameters are:
- The messageProcessingModel indicates the Message Processing - The messageProcessingModel indicates the Message Processing
Model by which the original incoming message was processed. Model by which the original incoming message was processed.
- The securityModel is that of the original incoming management - The securityModel is that of the original incoming management
target extracted from the cache. target extracted from the cache.
- The securityName is that of the original incoming management - The securityName is that of the original incoming management
target extracted from the cache. target extracted from the cache.
- The securityLevel is that of the original incoming management - The securityLevel is that of the original incoming management
target extracted from the cache. target extracted from the cache.
- The contextEngineID is the value extracted from the cache. - The contextEngineID is the value extracted from the cache.
- The contextName is the value extracted from the cache. - The contextName is the value extracted from the cache.
- The pduVersion indicates the version of the PDU to be - The pduVersion indicates the version of the PDU to be returned.
returned.
- The PDU is the (possibly translated) Response PDU. - The PDU is the (possibly translated) Response PDU.
- The maxSizeResponseScopedPDU is a local value indicating the - The maxSizeResponseScopedPDU is a local value indicating the
maximum size of a ScopedPDU that the application can accept. maximum size of a ScopedPDU that the application can accept.
- The stateReference is the value extracted from the cache. - The stateReference is the value extracted from the cache.
- The statusInformation indicates that no error occurred and - The statusInformation indicates that no error occurred and that
that a Response PDU message should be generated. a Response PDU message should be generated.
3.5.1.3. Processing an Incoming Internal-Class PDU 3.5.1.3. Processing an Incoming Internal-Class PDU
A proxy forwarder follows the following procedure when an incoming A proxy forwarder follows the following procedure when an incoming
Internal-Class PDU is received: Internal-Class PDU is received:
(1) The incoming Internal-Class PDU is received using the (1) The incoming Internal-Class PDU is received using the
processResponsePdu interface. The proxy forwarder uses the processResponsePdu interface. The proxy forwarder uses the
received parameters to locate an entry in its cache of pending received parameters to locate an entry in its cache of pending
forwarded requests. This is done by matching the received forwarded requests. This is done by matching the received
parameters with the cached values of sendPduHandle. If an parameters with the cached values of sendPduHandle. If an
appropriate cache entry cannot be found, processing of the appropriate cache entry cannot be found, processing of the
Internal-Class PDU is halted. Otherwise: Internal-Class PDU is halted. Otherwise:
(2) The cache information is extracted, and removed from the cache. (2) The cache information is extracted, and removed from the cache.
(3) If the original incoming management target information indicates an (3) If the original incoming management target information indicates
SNMP version which does not support Report PDUs, processing of the an SNMP version which does not support Report PDUs, processing
Internal-Class PDU is halted. of the Internal-Class PDU is halted.
(4) The proxy forwarder calls the Dispatcher using the (4) The proxy forwarder calls the Dispatcher using the
returnResponsePdu abstract service interface. Parameters are: returnResponsePdu abstract service interface. Parameters are:
- The messageProcessingModel indicates the Message Processing - The messageProcessingModel indicates the Message Processing
Model by which the original incoming message was processed. Model by which the original incoming message was processed.
- The securityModel is that of the original incoming management - The securityModel is that of the original incoming management
target extracted from the cache. target extracted from the cache.
- The securityName is that of the original incoming management - The securityName is that of the original incoming management
target extracted from the cache. target extracted from the cache.
- The securityLevel is that of the original incoming management - The securityLevel is that of the original incoming management
target extracted from the cache. target extracted from the cache.
- The contextEngineID is the value extracted from the cache. - The contextEngineID is the value extracted from the cache.
- The contextName is the value extracted from the cache. - The contextName is the value extracted from the cache.
- The pduVersion indicates the version of the PDU to be - The pduVersion indicates the version of the PDU to be returned.
returned.
- The PDU is unused. - The PDU is unused.
- The maxSizeResponseScopedPDU is a local value indicating the - The maxSizeResponseScopedPDU is a local value indicating the
maximum size of a ScopedPDU that the application can accept. maximum size of a ScopedPDU that the application can accept.
- The stateReference is the value extracted from the cache. - The stateReference is the value extracted from the cache.
- The statusInformation contains values specific to the - The statusInformation contains values specific to the Internal-
Internal-Class PDU type (for example, for a Report PDU, the Class PDU type (for example, for a Report PDU, the
statusInformation contains the contextEngineID, contextName, statusInformation contains the contextEngineID, contextName,
counter OID, and counter value received in the incoming Report counter OID, and counter value received in the incoming Report
PDU). PDU).
3.5.2. Notification Forwarding 3.5.2. Notification Forwarding
A proxy forwarder receives notifications in the same manner as a A proxy forwarder receives notifications in the same manner as a
notification receiver application, using the processPdu abstract notification receiver application, using the processPdu abstract
service interface. The following procedure is used when a service interface. The following procedure is used when a
notification is received: notification is received:
(1) The incoming management target information received from the (1) The incoming management target information received from the
processPdu interface is translated into outgoing management target processPdu interface is translated into outgoing management
information. Note that this translation may vary for different target information. Note that this translation may vary for
values of contextEngineID and/or contextName. The translation may different values of contextEngineID and/or contextName. The
result in multiple management targets. translation may result in multiple management targets.
(2) If appropriate outgoing management target information cannot be (2) If appropriate outgoing management target information cannot be
found and the notification was an Unconfirmed-Class PDU, processing found and the notification was an Unconfirmed-Class PDU,
of the notification is halted. If appropriate outgoing management processing of the notification is halted. If appropriate
target information cannot be found and the notification was a outgoing management target information cannot be found and the
Confirmed-Class PDU, the proxy forwarder increments the notification was a Confirmed-Class PDU, the proxy forwarder
snmpProxyDrops object, and calls the Dispatcher using the increments the snmpProxyDrops object, and calls the Dispatcher
returnResponsePdu abstract service interface. The parameters are: using the returnResponsePdu abstract service interface. The
parameters are:
- The messageProcessingModel is the received value. - The messageProcessingModel is the received value.
- The securityModel is the received value. - The securityModel is the received value.
- The securityName is the received value. - The securityName is the received value.
- The securityLevel is the received value. - The securityLevel is the received value.
- The contextEngineID is the received value. - The contextEngineID is the received value.
- The contextName is the received value. - The contextName is the received value.
- The pduVersion is the received value. - The pduVersion is the received value.
- The PDU is an undefined and unused value. - The PDU is an undefined and unused value.
- The maxSizeResponseScopedPDU is a local value indicating the - The maxSizeResponseScopedPDU is a local value indicating the
maximum size of a ScopedPDU that the application can accept. maximum size of a ScopedPDU that the application can accept.
- The stateReference is the received value. - The stateReference is the received value.
- The statusInformation indicates that an error occurred and - The statusInformation indicates that an error occurred and that
that a Report message should be generated. a Report message should be generated.
Processing of the message stops at this point. Otherwise, Processing of the message stops at this point. Otherwise,
(3) The proxy forwarder generates a notification using the procedures (3) The proxy forwarder generates a notification using the
described in the preceding section on Notification Originators, procedures described in the preceding section on Notification
with the following exceptions: Originators, with the following exceptions:
- The contextEngineID and contextName values from the original - The contextEngineID and contextName values from the original
received notification are used. received notification are used.
- The outgoing management targets previously determined are - The outgoing management targets previously determined are used.
used.
- No filtering mechanisms are applied. - No filtering mechanisms are applied.
- The variable-bindings from the original received notification - The variable-bindings from the original received notification
are used, rather than retrieving variable-bindings from local are used, rather than retrieving variable-bindings from local
MIB instrumentation. In particular, no access-control is MIB instrumentation. In particular, no access-control is
applied to these variable-bindings. applied to these variable-bindings.
- If the original notification contains a Confirmed-Class PDU, - If the original notification contains a Confirmed-Class PDU,
then any outgoing management targets, for which the outgoing then any outgoing management targets, for which the outgoing
SNMP version does not support and PDU types which are both SNMP version does not support and PDU types which are both
Notification-Class and Confirmed-Class PDUs, will not be used Notification-Class and Confirmed-Class PDUs, will not be used
when generating the forwarded notifications. when generating the forwarded notifications.
- If, for any of the outgoing management targets, the incoming - If, for any of the outgoing management targets, the incoming
SNMP version and the outgoing SNMP version support different SNMP version and the outgoing SNMP version support different PDU
PDU versions, the proxy forwarder may need to perform a versions, the proxy forwarder may need to perform a translation
translation on the PDU. (A method for performing such a on the PDU. (A method for performing such a translation is
translation is described in [COEX].) described in [COEX].)
(4) If the original received notification contains an Unconfirmed-Class (4) If the original received notification contains an Unconfirmed-
PDU, processing of the notification is now completed. Otherwise, Class PDU, processing of the notification is now completed.
the original received notification must contain a Confirmed-Class Otherwise, the original received notification must contain a
PDU, and processing continues. Confirmed-Class PDU, and processing continues.
(5) If the forwarded notifications included any Confirmed-Class PDUs, (5) If the forwarded notifications included any Confirmed-Class
processing continues when the procedures described in the section PDUs, processing continues when the procedures described in the
for Notification Originators determine that either: section for Notification Originators determine that either:
- None of the generated notifications containing Confirmed-Class - None of the generated notifications containing Confirmed-Class
PDUs have been successfully acknowledged within the longest of PDUs have been successfully acknowledged within the longest of
the time intervals, in which case processing of the original the time intervals, in which case processing of the original
notification is halted, or, notification is halted, or,
- At least one of the generated notifications containing - At least one of the generated notifications containing
Confirmed-Class PDUs is successfully acknowledged, in which Confirmed-Class PDUs is successfully acknowledged, in which case
case a response to the original received notification a response to the original received notification containing an
containing an Confirmed-Class PDU is generated as described in Confirmed-Class PDU is generated as described in the following
the following steps. steps.
(6) A Response-Class PDU is constructed, using the values of request-id (6) A Response-Class PDU is constructed, using the values of
and variable-bindings from the original received Notification-Class request-id and variable-bindings from the original received
PDU, and error-status and error-index values of 0. Notification-Class PDU, and error-status and error-index values
of 0.
(7) The Dispatcher is called using the returnResponsePdu abstract (7) The Dispatcher is called using the returnResponsePdu abstract
service interface. Parameters are: service interface. Parameters are:
- The messageProcessingModel is the originally received value. - The messageProcessingModel is the originally received value.
- The securityModel is the originally received value. - The securityModel is the originally received value.
- The securityName is the originally received value. - The securityName is the originally received value.
- The securityLevel is the originally received value. - The securityLevel is the originally received value.
- The contextEngineID is the originally received value. - The contextEngineID is the originally received value.
- The contextName is the originally received value. - The contextName is the originally received value.
- The pduVersion indicates the version of the PDU constructed in - The pduVersion indicates the version of the PDU constructed in
step (6) above. step (6) above.
- The PDU is the value constructed in step (6) above. - The PDU is the value constructed in step (6) above.
- The maxSizeResponseScopedPDU is a local value indicating the - The maxSizeResponseScopedPDU is a local value indicating the
maximum size of a ScopedPDU that the application can accept. maximum size of a ScopedPDU that the application can accept.
- The stateReference is the originally received value. - The stateReference is the originally received value.
- The statusInformation indicates that no error occurred and - The statusInformation indicates that no error occurred and that
that a Response-Class PDU message should be generated. a Response-Class PDU message should be generated.
4. The Structure of the MIB Modules 4. The Structure of the MIB Modules
There are three separate MIB modules described in this document, the There are three separate MIB modules described in this document, the
management target MIB, the notification MIB, and the proxy MIB. The management target MIB, the notification MIB, and the proxy MIB. The
following sections describe the structure of these three MIB modules. following sections describe the structure of these three MIB modules.
The use of these MIBs by particular types of applications is The use of these MIBs by particular types of applications is
described later in this document: described later in this document:
- The use of the management target MIB and the notification MIB - The use of the management target MIB and the notification MIB in
in notification originator applications is described in notification originator applications is described in section 6.
section 6.
- The use of the notification MIB for filtering notifications in - The use of the notification MIB for filtering notifications in
notification originator applications is described in section notification originator applications is described in section 7.
7.
- The use of the management target MIB and the proxy MIB in - The use of the management target MIB and the proxy MIB in proxy
proxy forwarding applications is described in section 8. forwarding applications is described in section 8.
4.1. The Management Target MIB Module 4.1. The Management Target MIB Module
The SNMP-TARGET-MIB module contains objects for defining management The SNMP-TARGET-MIB module contains objects for defining management
targets. It consists of two tables and conformance/compliance targets. It consists of two tables and conformance/compliance
statements. statements.
The first table, the snmpTargetAddrTable, contains information about The first table, the snmpTargetAddrTable, contains information about
transport domains and addresses. It also contains an object, transport domains and addresses. It also contains an object,
snmpTargetAddrTagList, which provides a mechanism for grouping snmpTargetAddrTagList, which provides a mechanism for grouping
skipping to change at page 34, line 17 skipping to change at page 29, line 35
The snmpTargetAddrTagList object is used for grouping entries in the The snmpTargetAddrTagList object is used for grouping entries in the
snmpTargetAddrTable. The value of this object contains a list of tag snmpTargetAddrTable. The value of this object contains a list of tag
values which are used to select target addresses to be used for a values which are used to select target addresses to be used for a
particular operation. particular operation.
A tag value, which may also be used in MIB objects other than A tag value, which may also be used in MIB objects other than
snmpTargetAddrTagList, is an arbitrary string of octets, but may not snmpTargetAddrTagList, is an arbitrary string of octets, but may not
contain a delimiter character. Delimiter characters are defined to contain a delimiter character. Delimiter characters are defined to
be one of the following characters: be one of the following characters:
- An ASCII space character (0x20). - An ASCII space character (0x20).
- An ASCII TAB character (0x09). - An ASCII TAB character (0x09).
- An ASCII carriage return (CR) character (0x0D). - An ASCII carriage return (CR) character (0x0D).
- An ASCII line feed (LF) character (0x0B). - An ASCII line feed (LF) character (0x0B).
In addition, a tag value may not have a zero length. Generally, a In addition, a tag value may not have a zero length. Generally, a
particular MIB object may contain either particular MIB object may contain either
- a single tag value, in which case the value of the MIB object - a single tag value, in which case the value of the MIB object
may not contain a delimiter character, or: may not contain a delimiter character, or:
- a MIB object may contain a list of tag values, separated by - a MIB object may contain a list of tag values, separated by
single delimiter characters. single delimiter characters.
For a list of tag values, these constraints imply certain For a list of tag values, these constraints imply certain
restrictions on the value of a MIB object: restrictions on the value of a MIB object:
- There cannot be a leading or trailing delimiter character. - There cannot be a leading or trailing delimiter character.
- There cannot be multiple adjacent delimiter characters. - There cannot be multiple adjacent delimiter characters.
4.1.2. Definitions 4.1.2. Definitions
SNMP-TARGET-MIB DEFINITIONS ::= BEGIN SNMP-TARGET-MIB DEFINITIONS ::= BEGIN
IMPORTS IMPORTS
MODULE-IDENTITY, MODULE-IDENTITY,
OBJECT-TYPE, OBJECT-TYPE,
snmpModules, snmpModules,
Counter32, Counter32,
skipping to change at page 35, line 29 skipping to change at page 30, line 48
FROM SNMP-FRAMEWORK-MIB FROM SNMP-FRAMEWORK-MIB
MODULE-COMPLIANCE, MODULE-COMPLIANCE,
OBJECT-GROUP OBJECT-GROUP
FROM SNMPv2-CONF; FROM SNMPv2-CONF;
snmpTargetMIB MODULE-IDENTITY snmpTargetMIB MODULE-IDENTITY
LAST-UPDATED "9808040000Z" LAST-UPDATED "9808040000Z"
ORGANIZATION "IETF SNMPv3 Working Group" ORGANIZATION "IETF SNMPv3 Working Group"
CONTACT-INFO CONTACT-INFO
"WG-email: snmpv3@tis.com "WG-email: snmpv3@lists.tislabs.com
Subscribe: majordomo@tis.com Subscribe: majordomo@lists.tislabs.com
In message body: subscribe snmpv3 In message body: subscribe snmpv3
Chair: Russ Mundy Chair: Russ Mundy
Trusted Information Systems Trusted Information Systems
Postal: 3060 Washington Rd Postal: 3060 Washington Rd
Glenwood MD 21738 Glenwood MD 21738
USA USA
EMail: mundy@tis.com EMail: mundy@tislabs.com
Phone: +1-301-854-6889 Phone: +1-301-854-6889
Co-editor: David B. Levi Co-editor: David B. Levi
SNMP Research, Inc. SNMP Research, Inc.
Postal: 3001 Kimberlin Heights Road Postal: 3001 Kimberlin Heights Road
Knoxville, TN 37920-9716 Knoxville, TN 37920-9716
EMail: levi@snmp.com EMail: levi@snmp.com
Phone: +1 423 573 1434 Phone: +1 423 573 1434
Co-editor: Paul Meyer Co-editor: Paul Meyer
skipping to change at page 36, line 20 skipping to change at page 31, line 37
Postal: 170 West Tasman Drive Postal: 170 West Tasman Drive
San Jose, CA 95134-1706 San Jose, CA 95134-1706
EMail: bstewart@cisco.com EMail: bstewart@cisco.com
Phone: +1 603 654 2686" Phone: +1 603 654 2686"
DESCRIPTION DESCRIPTION
"This MIB module defines MIB objects which provide "This MIB module defines MIB objects which provide
mechanisms to remotely configure the parameters used mechanisms to remotely configure the parameters used
by an SNMP entity for the generation of SNMP messages." by an SNMP entity for the generation of SNMP messages."
REVISION "9808040000Z" REVISION "9808040000Z"
DESCRIPTION "Clarifications, published as DESCRIPTION "Clarifications, published as
draft-ietf-snmpv3-appl-v2-01.txt." RFC2573."
REVISION "9707140000Z" REVISION "9707140000Z"
DESCRIPTION "The initial revision, published as RFC2273." DESCRIPTION "The initial revision, published as RFC2273."
::= { snmpModules 12 } ::= { snmpModules 12 }
snmpTargetObjects OBJECT IDENTIFIER ::= { snmpTargetMIB 1 } snmpTargetObjects OBJECT IDENTIFIER ::= { snmpTargetMIB 1 }
snmpTargetConformance OBJECT IDENTIFIER ::= { snmpTargetMIB 3 } snmpTargetConformance OBJECT IDENTIFIER ::= { snmpTargetMIB 3 }
SnmpTagValue ::= TEXTUAL-CONVENTION SnmpTagValue ::= TEXTUAL-CONVENTION
DISPLAY-HINT "255a" DISPLAY-HINT "255a"
STATUS current STATUS current
skipping to change at page 50, line 5 skipping to change at page 44, line 17
FROM SNMP-TARGET-MIB FROM SNMP-TARGET-MIB
MODULE-COMPLIANCE, MODULE-COMPLIANCE,
OBJECT-GROUP OBJECT-GROUP
FROM SNMPv2-CONF; FROM SNMPv2-CONF;
snmpNotificationMIB MODULE-IDENTITY snmpNotificationMIB MODULE-IDENTITY
LAST-UPDATED "9808040000Z" LAST-UPDATED "9808040000Z"
ORGANIZATION "IETF SNMPv3 Working Group" ORGANIZATION "IETF SNMPv3 Working Group"
CONTACT-INFO CONTACT-INFO
"WG-email: snmpv3@tis.com "WG-email: snmpv3@lists.tislabs.com
Subscribe: majordomo@tis.com Subscribe: majordomo@lists.tislabs.com
In message body: subscribe snmpv3 In message body: subscribe snmpv3
Chair: Russ Mundy Chair: Russ Mundy
Trusted Information Systems Trusted Information Systems
Postal: 3060 Washington Rd Postal: 3060 Washington Rd
Glenwood MD 21738 Glenwood MD 21738
USA USA
EMail: mundy@tis.com EMail: mundy@tislabs.com
Phone: +1-301-854-6889 Phone: +1-301-854-6889
Co-editor: David B. Levi Co-editor: David B. Levi
SNMP Research, Inc. SNMP Research, Inc.
Postal: 3001 Kimberlin Heights Road Postal: 3001 Kimberlin Heights Road
Knoxville, TN 37920-9716 Knoxville, TN 37920-9716
EMail: levi@snmp.com EMail: levi@snmp.com
Phone: +1 423 573 1434 Phone: +1 423 573 1434
Co-editor: Paul Meyer Co-editor: Paul Meyer
skipping to change at page 50, line 44 skipping to change at page 45, line 7
San Jose, CA 95134-1706 San Jose, CA 95134-1706
EMail: bstewart@cisco.com EMail: bstewart@cisco.com
Phone: +1 603 654 2686" Phone: +1 603 654 2686"
DESCRIPTION DESCRIPTION
"This MIB module defines MIB objects which provide "This MIB module defines MIB objects which provide
mechanisms to remotely configure the parameters mechanisms to remotely configure the parameters
used by an SNMP entity for the generation of used by an SNMP entity for the generation of
notifications." notifications."
REVISION "9808040000Z" REVISION "9808040000Z"
DESCRIPTION "Clarifications, published as DESCRIPTION "Clarifications, published as
draft-ietf-snmpv3-appl-v2-01.txt." RFC2573"
REVISION "9707140000Z" REVISION "9707140000Z"
DESCRIPTION "The initial revision, published as RFC2273." DESCRIPTION "The initial revision, published as RFC2273."
::= { snmpModules 13 } ::= { snmpModules 13 }
snmpNotifyObjects OBJECT IDENTIFIER ::= snmpNotifyObjects OBJECT IDENTIFIER ::=
{ snmpNotificationMIB 1 } { snmpNotificationMIB 1 }
snmpNotifyConformance OBJECT IDENTIFIER ::= snmpNotifyConformance OBJECT IDENTIFIER ::=
{ snmpNotificationMIB 3 } { snmpNotificationMIB 3 }
-- --
-- --
-- The snmpNotifyObjects group -- The snmpNotifyObjects group
-- --
-- --
snmpNotifyTable OBJECT-TYPE snmpNotifyTable OBJECT-TYPE
skipping to change at page 55, line 17 skipping to change at page 49, line 23
to determine whether particular management targets should to determine whether particular management targets should
receive particular notifications. receive particular notifications.
When a notification is generated, it must be compared When a notification is generated, it must be compared
with the filters associated with each management target with the filters associated with each management target
which is configured to receive notifications, in order to which is configured to receive notifications, in order to
determine whether it may be sent to each such management determine whether it may be sent to each such management
target. target.
A more complete discussion of notification filtering A more complete discussion of notification filtering
can be found in section 6. of [SNMP-APPL]." can be found in section 6. of [RFC2573]."
::= { snmpNotifyObjects 3 } ::= { snmpNotifyObjects 3 }
snmpNotifyFilterEntry OBJECT-TYPE snmpNotifyFilterEntry OBJECT-TYPE
SYNTAX SnmpNotifyFilterEntry SYNTAX SnmpNotifyFilterEntry
MAX-ACCESS not-accessible MAX-ACCESS not-accessible
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"An element of a filter profile. "An element of a filter profile.
Entries in the snmpNotifyFilterTable are created and Entries in the snmpNotifyFilterTable are created and
skipping to change at page 57, line 20 skipping to change at page 51, line 25
SYNTAX INTEGER { SYNTAX INTEGER {
included(1), included(1),
excluded(2) excluded(2)
} }
MAX-ACCESS read-create MAX-ACCESS read-create
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"This object indicates whether the family of filter subtrees "This object indicates whether the family of filter subtrees
defined by this entry are included in or excluded from a defined by this entry are included in or excluded from a
filter. A more detailed discussion of the use of this filter. A more detailed discussion of the use of this
object can be found in section 6. of [SNMP-APPL]." object can be found in section 6. of [RFC2573]."
DEFVAL { included } DEFVAL { included }
::= { snmpNotifyFilterEntry 3 } ::= { snmpNotifyFilterEntry 3 }
snmpNotifyFilterStorageType OBJECT-TYPE snmpNotifyFilterStorageType OBJECT-TYPE
SYNTAX StorageType SYNTAX StorageType
MAX-ACCESS read-create MAX-ACCESS read-create
STATUS current STATUS current
DESCRIPTION DESCRIPTION
"The storage type of this conceptual row." "The storage type of this conceptual row."
DEFVAL { nonVolatile } DEFVAL { nonVolatile }
skipping to change at page 62, line 42 skipping to change at page 56, line 16
FROM SNMP-TARGET-MIB FROM SNMP-TARGET-MIB
MODULE-COMPLIANCE, MODULE-COMPLIANCE,
OBJECT-GROUP OBJECT-GROUP
FROM SNMPv2-CONF; FROM SNMPv2-CONF;
snmpProxyMIB MODULE-IDENTITY snmpProxyMIB MODULE-IDENTITY
LAST-UPDATED "9808040000Z" LAST-UPDATED "9808040000Z"
ORGANIZATION "IETF SNMPv3 Working Group" ORGANIZATION "IETF SNMPv3 Working Group"
CONTACT-INFO CONTACT-INFO
"WG-email: snmpv3@tis.com "WG-email: snmpv3@lists.tislabs.com
Subscribe: majordomo@tis.com Subscribe: majordomo@lists.tislabs.com
In message body: subscribe snmpv3 In message body: subscribe snmpv3
Chair: Russ Mundy Chair: Russ Mundy
Trusted Information Systems Trusted Information Systems
Postal: 3060 Washington Rd Postal: 3060 Washington Rd
Glenwood MD 21738 Glenwood MD 21738
USA USA
EMail: mundy@tislabs.com
EMail: mundy@tis.com
Phone: +1-301-854-6889 Phone: +1-301-854-6889
Co-editor: David B. Levi Co-editor: David B. Levi
SNMP Research, Inc. SNMP Research, Inc.
Postal: 3001 Kimberlin Heights Road Postal: 3001 Kimberlin Heights Road
Knoxville, TN 37920-9716 Knoxville, TN 37920-9716
EMail: levi@snmp.com EMail: levi@snmp.com
Phone: +1 423 573 1434 Phone: +1 423 573 1434
Co-editor: Paul Meyer Co-editor: Paul Meyer
skipping to change at page 63, line 34 skipping to change at page 57, line 5
Postal: 170 West Tasman Drive Postal: 170 West Tasman Drive
San Jose, CA 95134-1706 San Jose, CA 95134-1706
EMail: bstewart@cisco.com EMail: bstewart@cisco.com
Phone: +1 603 654 2686" Phone: +1 603 654 2686"
DESCRIPTION DESCRIPTION
"This MIB module defines MIB objects which provide "This MIB module defines MIB objects which provide
mechanisms to remotely configure the parameters mechanisms to remotely configure the parameters
used by a proxy forwarding application." used by a proxy forwarding application."
REVISION "9808040000Z" REVISION "9808040000Z"
DESCRIPTION "Clarifications, published as DESCRIPTION "Clarifications, published as
draft-ietf-snmpv3-appl-v2-01.txt." RFC2573."
REVISION "9707140000Z" REVISION "9707140000Z"
DESCRIPTION "The initial revision, published as RFC2273." DESCRIPTION "The initial revision, published as RFC2273."
::= { snmpModules 14 } ::= { snmpModules 14 }
snmpProxyObjects OBJECT IDENTIFIER ::= { snmpProxyMIB 1 } snmpProxyObjects OBJECT IDENTIFIER ::= { snmpProxyMIB 1 }
snmpProxyConformance OBJECT IDENTIFIER ::= { snmpProxyMIB 3 } snmpProxyConformance OBJECT IDENTIFIER ::= { snmpProxyMIB 3 }
-- --
-- --
-- The snmpProxyObjects group -- The snmpProxyObjects group
skipping to change at page 72, line 21 skipping to change at page 63, line 46
There are actually two mechanisms a proxy forwarder may use, one for There are actually two mechanisms a proxy forwarder may use, one for
forwarding request messages, and one for forwarding notification forwarding request messages, and one for forwarding notification
messages. messages.
7.1. Management Target Translation for Request Forwarding 7.1. Management Target Translation for Request Forwarding
When forwarding request messages, the proxy forwarder will select a When forwarding request messages, the proxy forwarder will select a
single entry in the snmpProxyTable. To select this entry, it will single entry in the snmpProxyTable. To select this entry, it will
perform the following comparisons: perform the following comparisons:
- The snmpProxyType must be read(1) if the request is a Read- - The snmpProxyType must be read(1) if the request is a Read-
Class PDU. The snmpProxyType must be write(2) if the request Class PDU. The snmpProxyType must be write(2) if the request is
is a Write-Class PDU. a Write-Class PDU.
- The contextEngineID must equal the snmpProxyContextEngineID - The contextEngineID must equal the snmpProxyContextEngineID
object. object.
- If the snmpProxyContextName object is supported, it must equal - If the snmpProxyContextName object is supported, it must equal
the contextName. the contextName.
- The snmpProxyTargetParamsIn object identifies an entry in the - The snmpProxyTargetParamsIn object identifies an entry in the
snmpTargetParamsTable. The messageProcessingModel, snmpTargetParamsTable. The messageProcessingModel,
securityLevel, security model, and securityName must match the securityLevel, security model, and securityName must match the
values of snmpTargetParamsMPModel, values of snmpTargetParamsMPModel,
snmpTargetParamsSecurityModel, snmpTargetParamsSecurityName, snmpTargetParamsSecurityModel, snmpTargetParamsSecurityName, and
and snmpTargetParamsSecurityLevel of the identified entry in snmpTargetParamsSecurityLevel of the identified entry in the
the snmpTargetParamsTable. snmpTargetParamsTable.
There may be multiple entries in the snmpProxyTable for which these There may be multiple entries in the snmpProxyTable for which these
comparisons succeed. The entry whose snmpProxyName has the comparisons succeed. The entry whose snmpProxyName has the
lexicographically smallest value and for which the comparisons lexicographically smallest value and for which the comparisons
succeed will be selected by the proxy forwarder. succeed will be selected by the proxy forwarder.
The outgoing management target information is identified by the value The outgoing management target information is identified by the value
of the snmpProxySingleTargetOut object of the selected entry. This of the snmpProxySingleTargetOut object of the selected entry. This
object identifies an entry in the snmpTargetAddrTable. The object identifies an entry in the snmpTargetAddrTable. The
identified entry in the snmpTargetAddrTable also contains a reference identified entry in the snmpTargetAddrTable also contains a reference
skipping to change at page 73, line 24 skipping to change at page 64, line 48
snmpTargetParamsSecurityModel, snmpTargetParamsSecurityName, and snmpTargetParamsSecurityModel, snmpTargetParamsSecurityName, and
snmpTargetParamsSecurityLevel of the identified snmpTargetParamsEntry snmpTargetParamsSecurityLevel of the identified snmpTargetParamsEntry
are used as the destination management target. are used as the destination management target.
7.2. Management Target Translation for Notification Forwarding 7.2. Management Target Translation for Notification Forwarding
When forwarding notification messages, the proxy forwarder will When forwarding notification messages, the proxy forwarder will
select multiple entries in the snmpProxyTable. To select these select multiple entries in the snmpProxyTable. To select these
entries, it will perform the following comparisons: entries, it will perform the following comparisons:
- The snmpProxyType must be trap(3) if the notification is an - The snmpProxyType must be trap(3) if the notification is an
Unconfirmed-Class PDU. The snmpProxyType must be inform(4) if Unconfirmed-Class PDU. The snmpProxyType must be inform(4) if
the request is a Confirmed-Class PDU. the request is a Confirmed-Class PDU.
- The contextEngineID must equal the snmpProxyContextEngineID - The contextEngineID must equal the snmpProxyContextEngineID
object. object.
- If the snmpProxyContextName object is supported, it must equal - If the snmpProxyContextName object is supported, it must equal
the contextName. the contextName.
- The snmpProxyTargetParamsIn object identifies an entry in the - The snmpProxyTargetParamsIn object identifies an entry in the
snmpTargetParamsTable. The messageProcessingModel, snmpTargetParamsTable. The messageProcessingModel,
securityLevel, security model, and securityName must match the securityLevel, security model, and securityName must match the
values of snmpTargetParamsMPModel, values of snmpTargetParamsMPModel,
snmpTargetParamsSecurityModel, snmpTargetParamsSecurityName, snmpTargetParamsSecurityModel, snmpTargetParamsSecurityName, and
and snmpTargetParamsSecurityLevel of the identified entry in snmpTargetParamsSecurityLevel of the identified entry in the
the snmpTargetParamsTable. snmpTargetParamsTable.
All entries for which these conditions are met are selected. The All entries for which these conditions are met are selected. The
snmpProxyMultipleTargetOut object of each such entry is used to snmpProxyMultipleTargetOut object of each such entry is used to
select a set of entries in the snmpTargetAddrTable. Any select a set of entries in the snmpTargetAddrTable. Any
snmpTargetAddrEntry whose snmpTargetAddrTagList object contains a tag snmpTargetAddrEntry whose snmpTargetAddrTagList object contains a tag
value equal to the value of snmpProxyMultipleTargetOut, and whose value equal to the value of snmpProxyMultipleTargetOut, and whose
snmpTargetAddrParams object references an existing entry in the snmpTargetAddrParams object references an existing entry in the
snmpTargetParamsTable, is selected as a destination for the forwarded snmpTargetParamsTable, is selected as a destination for the forwarded
notification. notification.
skipping to change at page 74, line 33 skipping to change at page 66, line 11
rights which may cover technology that may be required to practice rights which may cover technology that may be required to practice
this standard. Please address the information to the IETF Executive this standard. Please address the information to the IETF Executive
Director. Director.
9. Acknowledgments 9. Acknowledgments
This document is the result of the efforts of the SNMPv3 Working This document is the result of the efforts of the SNMPv3 Working
Group. Some special thanks are in order to the following SNMPv3 WG Group. Some special thanks are in order to the following SNMPv3 WG
members: members:
Harald Tveit Alvestrand (Maxware) Harald Tveit Alvestrand (Maxware)
Dave Battle (SNMP Research, Inc.) Dave Battle (SNMP Research, Inc.)
Alan Beard (Disney Worldwide Services) Alan Beard (Disney Worldwide Services)
Paul Berrevoets (SWI Systemware/Halcyon Inc.) Paul Berrevoets (SWI Systemware/Halcyon Inc.)
Martin Bjorklund (Ericsson) Martin Bjorklund (Ericsson)
Uri Blumenthal (IBM T.J. Watson Research Center) Uri Blumenthal (IBM T.J. Watson Research Center)
Jeff Case (SNMP Research, Inc.) Jeff Case (SNMP Research, Inc.)
John Curran (BBN) John Curran (BBN)
Mike Daniele (Compaq Computer Corporation) Mike Daniele (Compaq Computer Corporation)
T. Max Devlin (Eltrax Systems) T. Max Devlin (Eltrax Systems)
John Flick (Hewlett Packard) John Flick (Hewlett Packard)
Rob Frye (MCI) Rob Frye (MCI)
Wes Hardaker (U.C.Davis, Information Technology - D.C.A.S.) Wes Hardaker (U.C.Davis, Information Technology - D.C.A.S.)
David Harrington (Cabletron Systems Inc.) David Harrington (Cabletron Systems Inc.)
Lauren Heintz (BMC Software, Inc.) Lauren Heintz (BMC Software, Inc.)
N.C. Hien (IBM T.J. Watson Research Center) N.C. Hien (IBM T.J. Watson Research Center)
Michael Kirkham (InterWorking Labs, Inc.) Michael Kirkham (InterWorking Labs, Inc.)
Dave Levi (SNMP Research, Inc.) Dave Levi (SNMP Research, Inc.)
Louis A Mamakos (UUNET Technologies Inc.) Louis A Mamakos (UUNET Technologies Inc.)
Joe Marzot (Nortel Networks) Joe Marzot (Nortel Networks)
Paul Meyer (Secure Computing Corporation) Paul Meyer (Secure Computing Corporation)
Keith McCloghrie (Cisco Systems) Keith McCloghrie (Cisco Systems)
Bob Moore (IBM) Bob Moore (IBM)
Russ Mundy (TIS Labs at Network Associates) Russ Mundy (TIS Labs at Network Associates)
Bob Natale (ACE*COMM Corporation) Bob Natale (ACE*COMM Corporation)
Mike O'Dell (UUNET Technologies Inc.) Mike O'Dell (UUNET Technologies Inc.)
Dave Perkins (DeskTalk) Dave Perkins (DeskTalk)
Peter Polkinghorne (Brunel University) Peter Polkinghorne (Brunel University)
Randy Presuhn (BMC Software, Inc.) Randy Presuhn (BMC Software, Inc.)
David Reeder (TIS Labs at Network Associates) David Reeder (TIS Labs at Network Associates)
David Reid (SNMP Research, Inc.) David Reid (SNMP Research, Inc.)
Aleksey Romanov (Quality Quorum) Aleksey Romanov (Quality Quorum)
Shawn Routhier (Epilogue) Shawn Routhier (Epilogue)
Juergen Schoenwaelder (TU Braunschweig) Juergen Schoenwaelder (TU Braunschweig)
Bob Stewart (Cisco Systems) Bob Stewart (Cisco Systems)
Mike Thatcher (Independent Consultant) Mike Thatcher (Independent Consultant)
Bert Wijnen (IBM T.J. Watson Research Center) Bert Wijnen (IBM T.J. Watson Research Center)
The document is based on recommendations of the IETF Security and The document is based on recommendations of the IETF Security and
Administrative Framework Evolution for SNMP Advisory Team. Members of Administrative Framework Evolution for SNMP Advisory Team. Members of
that Advisory Team were: that Advisory Team were:
David Harrington (Cabletron Systems Inc.) David Harrington (Cabletron Systems Inc.)
Jeff Johnson (Cisco Systems) Jeff Johnson (Cisco Systems)
David Levi (SNMP Research Inc.) David Levi (SNMP Research Inc.)
John Linn (Openvision) John Linn (Openvision)
Russ Mundy (Trusted Information Systems) chair Russ Mundy (Trusted Information Systems) chair
Shawn Routhier (Epilogue) Shawn Routhier (Epilogue)
Glenn Waters (Nortel) Glenn Waters (Nortel)
Bert Wijnen (IBM T. J. Watson Research Center) Bert Wijnen (IBM T. J. Watson Research Center)
As recommended by the Advisory Team and the SNMPv3 Working Group As recommended by the Advisory Team and the SNMPv3 Working Group
Charter, the design incorporates as much as practical from previous Charter, the design incorporates as much as practical from previous
RFCs and drafts. As a result, special thanks are due to the authors RFCs and drafts. As a result, special thanks are due to the authors
of previous designs known as SNMPv2u and SNMPv2*: of previous designs known as SNMPv2u and SNMPv2*:
Jeff Case (SNMP Research, Inc.) Jeff Case (SNMP Research, Inc.)
David Harrington (Cabletron Systems Inc.) David Harrington (Cabletron Systems Inc.)
David Levi (SNMP Research, Inc.) David Levi (SNMP Research, Inc.)
Keith McCloghrie (Cisco Systems) Keith McCloghrie (Cisco Systems)
Brian O'Keefe (Hewlett Packard) Brian O'Keefe (Hewlett Packard)
Marshall T. Rose (Dover Beach Consulting) Marshall T. Rose (Dover Beach Consulting)
Jon Saperia (BGS Systems Inc.) Jon Saperia (BGS Systems Inc.)
Steve Waldbusser (International Network Services) Steve Waldbusser (International Network Services)
Glenn W. Waters (Bell-Northern Research Ltd.) Glenn W. Waters (Bell-Northern Research Ltd.)
10. Security Considerations 10. Security Considerations
The SNMP applications described in this document typically have The SNMP applications described in this document typically have
direct access to MIB instrumentation. Thus, it is very important direct access to MIB instrumentation. Thus, it is very important
that these applications be strict in their application of access that these applications be strict in their application of access
control as described in this document. control as described in this document.
In addition, there may be some types of notification generator In addition, there may be some types of notification generator
applications which, rather than accessing MIB instrumentation using applications which, rather than accessing MIB instrumentation using
skipping to change at page 77, line 7 skipping to change at page 67, line 49
as from a command line). The implementors and users of such as from a command line). The implementors and users of such
applications must be responsible for not divulging MIB information applications must be responsible for not divulging MIB information
that normally would be inaccessible due to access control. that normally would be inaccessible due to access control.
Finally, the MIBs described in this document contain potentially Finally, the MIBs described in this document contain potentially
sensitive information. A security administrator may wish to limit sensitive information. A security administrator may wish to limit
access to these MIBs. access to these MIBs.
11. References 11. References
[COEX] [COEX] The SNMPv3 Working Group, Frye, R.,Levi, D., Wijnen, B.,
The SNMPv3 Working Group, Frye, R.,Levi, D., Wijnen, B., "Coexistence between Version 1, Version 2, and Version 3
"Coexistence between Version 1, Version 2, and Version 3 of the of the Internet-standard Network Management Framework",
Internet-standard Network Management Framework", draft-ietf- Work in Progress.
snmpv3-coex-03.txt, February 1999.
[RFC1157] [RFC1157] Case, J., Fedor, M., Schoffstall, M. and J. Davin,
Case, J., Fedor, M., Schoffstall, M., and J. Davin, "Simple Network "Simple Network Management Protocol", STD 15, RFC 1157,
Management Protocol", RFC 1157, SNMP Research, Performance Systems May 1990.
International, Performance Systems International, MIT Laboratory
for Computer Science, May 1990.
[RFC1213] [RFC1213] McCloghrie, K. and M. Rose, Editors, "Management
McCloghrie, K., and M. Rose, Editors, "Management Information Base Information Base for Network Management of TCP/IP-based
for Network Management of TCP/IP-based internets: MIB-II", STD 17, internets: MIB-II", STD 17, RFC 1213, March 1991.
RFC 1213, Hughes LAN Systems, Performance Systems International,
March 1991.
[RFC1902] [RFC2578] McCloghrie, K., Perkins, D. and J. Schoenwaelder,
SNMPv2 Working Group, Case, J., McCloghrie, K., Rose, M., and S. "Structure of Management Information Version 2 (SMIv2)",
Waldbusser, "Structure of Management Information for Version 2 of STD 58, RFC 2578, April 1999.
the Simple Network Management Protocol (SNMPv2)", RFC1902, SNMP
Research,Inc., Cisco Systems, Inc., Dover Beach Consulting, Inc.,
International Network Services, January 1996.
[RFC1903] [RFC2579] McCloghrie, K., Perkins, D. and J. Schoenwaelder,
SNMPv2 Working Group, Case, J., McCloghrie, K., Rose, M., and S. "Textual Conventions for SMIv2", STD 58, RFC 2579, April
Waldbusser, "Textual Conventions for Version 2 of the Simple 1999.
Network Management Protocol (SNMPv2)", RFC1903, SNMP Research,Inc.,
Cisco Systems, Inc., Dover Beach Consulting, Inc., International
Network Services, January 1996.
[RFC1905] [RFC1905] SNMPv2 Working Group, Case, J., McCloghrie, K., Rose, M.
SNMPv2 Working Group, Case, J., McCloghrie, K., Rose, M., and S. and S. Waldbusser, "Protocol Operations for Version 2 of
Waldbusser, "Protocol Operations for Version 2 of the Simple the Simple Network Management Protocol (SNMPv2)",
Network Management Protocol (SNMPv2)", RFC1905, SNMP Research,Inc., RFC1905, January 1996.
Cisco Systems, Inc., Dover Beach Consulting, Inc., International
Network Services, January 1996.
[RFC1907] [RFC1907] SNMPv2 Working Group, Case, J., McCloghrie, K., Rose, M.
SNMPv2 Working Group, Case, J., McCloghrie, K., Rose, M., and S. and S. Waldbusser, "Management Information Base for
Waldbusser, "Management Information Base for Version 2 of the Version 2 of the Simple Network Management Protocol
Simple Network Management Protocol (SNMPv2)", RFC1905, SNMP (SNMPv2)", RFC1905, January 1996.
Research,Inc., Cisco Systems, Inc., Dover Beach Consulting, Inc.,
International Network Services, January 1996.
[RFC1908] [RFC1908] SNMPv2 Working Group, Case, J., McCloghrie, K., Rose, M.
SNMPv2 Working Group, Case, J., McCloghrie, K., Rose, M., and S. and S. Waldbusser, "Coexistence between Version 1 and
Waldbusser, "Coexistence between Version 1 and Version 2 of the Version 2 of the Internet-standard Network Management
Internet-standard Network Management Framework", RFC1905, SNMP Framework", RFC1905, January 1996.
Research,Inc., Cisco Systems, Inc., Dover Beach Consulting, Inc.,
International Network Services, January 1996.
[RFC2119] [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Bradner, S., "Key words for use in RFCs to Indicate Requirement Requirement Levels", BCP 14, RFC2119, March 1997.
Levels", BCP 14, RFC2119, March 1997.
[SNMP-ARCH] [RFC2571] Harrington, D., Presuhn, R. and B. Wijnen, "An Architecture
The SNMPv3 Working Group, Harrington, D., Wijnen, B., "An for Describing SNMP Management Frameworks", RFC 2571,
Architecture for Describing SNMP Management Frameworks", draft- April 1999.
ietf-snmpv3-arch-05.txt, February 1999.
[SNMP-MPD] [RFC2572] Case, J., Harrington, D., Presuhn, R. and B. Wijnen,
The SNMPv3 Working Group, Case, J., Harrington, D., Wijnen, B., "Message Processing and Dispatching for the Simple
"Message Processing and Dispatching for the Simple Network Network Management Protocol (SNMP)", RFC 2572, April
Management Protocol (SNMP)", draft-ietf-snmpv3-mpc-05.txt, February 1999.
1999.
[SNMP-ACM] [RFC2575] Wijnen, B., Presuhn, R. and K. McCloghrie, "View-based
The SNMPv3 Working Group, Wijnen, B., Presuhn, R., McCloghrie, K., Access Control Model for the Simple Network Management
"View-based Access Control Model for the Simple Network Management Protocol (SNMP)", RFC 2575, April 1999.
Protocol (SNMP)", draft-ietf-snmpv3-vacm-04.txt, February 1999.
[SNMP-APPL] [RFC2573] Levi, D. B., Meyer, P. and B. Stewart, "SNMP Applications",
The SNMPv3 Working Group, Levi, D., Meyer, P., Stewart, B., "SNMP RFC 2573, April 1999.
Applications", draft-ietf-snmpv3-appl-v2-03.txt, February 1999.
12. Editor's Address 12. Editors' Addresses
David B. Levi David B. Levi
SNMP Research, Inc. SNMP Research, Inc.
3001 Kimberlin Heights Road 3001 Kimberlin Heights Road
Knoxville, TN 37920-9716 Knoxville, TN 37920-9716
U.S.A. U.S.A.
Phone: +1 423 573 1434
EMail: levi@snmp.com
Paul Meyer Phone: +1 423 573 1434
Secure Computing Corporation EMail: levi@snmp.com
2675 Long Lake Road
Roseville, MN 55113
U.S.A.
Phone: +1 651 628 1592
EMail: paul_meyer@securecomputing.com
Bob Stewart Paul Meyer
Cisco Systems, Inc. Secure Computing Corporation
170 West Tasman Drive 2675 Long Lake Road
San Jose, CA 95134-1706 Roseville, MN 55113
U.S.A. U.S.A.
Phone: +1 603 654 2686
EMail: bstewart@cisco.com
APPENDIX A - Trap Configuration Example Phone: +1 651 628 1592
EMail: paul_meyer@securecomputing.com
Bob Stewart
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
U.S.A.
Phone: +1 603 654 2686
EMail: bstewart@cisco.com
APPENDIX A - Trap Configuration Example
This section describes an example configuration for a Notification This section describes an example configuration for a Notification
Generator application which implements the snmpNotifyBasicCompliance Generator application which implements the snmpNotifyBasicCompliance
level. The example configuration specifies that the Notification level. The example configuration specifies that the Notification
Generator should send notifications to 3 separate managers, using Generator should send notifications to 3 separate managers, using
authentication and no privacy for the first 2 managers, and using authentication and no privacy for the first 2 managers, and using
both authentication and privacy for the third manager. both authentication and privacy for the third manager.
The configuration consists of three rows in the snmpTargetAddrTable, The configuration consists of three rows in the snmpTargetAddrTable,
and two rows in the snmpTargetTable. and two rows in the snmpTargetTable.
skipping to change at page 81, line 4 skipping to change at page 70, line 52
* snmpTargetAddrName = "addr3" * snmpTargetAddrName = "addr3"
snmpTargetAddrTDomain = snmpUDPDomain snmpTargetAddrTDomain = snmpUDPDomain
snmpTargetAddrTAddress = 128.1.2.3/162 snmpTargetAddrTAddress = 128.1.2.3/162
snmpTargetAddrTagList = "group2" snmpTargetAddrTagList = "group2"
snmpTargetAddrParams = "AuthPriv-bob" snmpTargetAddrParams = "AuthPriv-bob"
snmpTargetAddrStorageType = readOnly(5) snmpTargetAddrStorageType = readOnly(5)
snmpTargetAddrRowStatus = active(1) snmpTargetAddrRowStatus = active(1)
* snmpTargetParamsName = "AuthNoPriv-joe" * snmpTargetParamsName = "AuthNoPriv-joe"
snmpTargetParamsMPModel = 3 snmpTargetParamsMPModel = 3m
snmpTargetParamsSecurityModel = 3 (USM) snmpTargetParamsSecurityModel = 3 (USM)
snmpTargetParamsSecurityName = "joe" snmpTargetParamsSecurityName = "joe"
snmpTargetParamsSecurityLevel = authNoPriv(2) snmpTargetParamsSecurityLevel = authNoPriv(2)
snmpTargetParamsStorageType = readOnly(5) snmpTargetParamsStorageType = readOnly(5)
snmpTargetParamsRowStatus = active(1) snmpTargetParamsRowStatus = active(1)
* snmpTargetParamsName = "AuthPriv-bob" * snmpTargetParamsName = "AuthPriv-bob"
snmpTargetParamsMPModel = 3 snmpTargetParamsMPModel = 3
snmpTargetParamsSecurityModel = 3 (USM) snmpTargetParamsSecurityModel = 3 (USM)
snmpTargetParamsSecurityName = "bob" snmpTargetParamsSecurityName = "bob"
skipping to change at page 82, line 5 skipping to change at page 72, line 5
And the second group contains a single management target: And the second group contains a single management target:
messageProcessingModel SNMPv3 messageProcessingModel SNMPv3
securityLevel authPriv(3) securityLevel authPriv(3)
securityModel 3 (USM) securityModel 3 (USM)
securityName "bob" securityName "bob"
transportDomain snmpUDPDomain transportDomain snmpUDPDomain
transportAddress 128.1.5.9/162 transportAddress 128.1.5.9/162
B. Full Copyright Statement Appendix B. Full Copyright Statement
Copyright (C) The Internet Society (1999). All Rights Reserved.
This document and translations of it may be copied and furnished to This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it others, and derivative works that comment on or otherwise explain it
or assist in its implementation may be prepared, copied, published or assist in its implementation may be prepared, copied, published
and distributed, in whole or in part, without restriction of any and distributed, in whole or in part, without restriction of any
kind, provided that the above copyright notice and this paragraph are kind, provided that the above copyright notice and this paragraph are
included on all such copies and derivative works. However, this included on all such copies and derivative works. However, this
document itself may not be modified in any way, such as by removing document itself may not be modified in any way, such as by removing
the copyright notice or references to the Internet Society or other the copyright notice or references to the Internet Society or other
Internet organizations, except as needed for the purpose of Internet organizations, except as needed for the purpose of
developing Internet standards in which case the procedures for developing Internet standards in which case the procedures for
copyrights defined in the Internet Standards process must be copyrights defined in the Internet Standards process must be
followed, or as required to translate it into languages other than followed, or as required to translate it into languages other than
English. English.
The limited permissions granted above are perpetual and will not be The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assigns. revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an This document and the information contained herein is provided on an
"AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Acknowledgement
Funding for the RFC Editor function is currently provided by
the Internet Society.
 End of changes. 310 change blocks. 
864 lines changed or deleted 824 lines changed or added

This html diff was produced by rfcdiff 1.41. The latest version is available from http://tools.ietf.org/tools/rfcdiff/