(Optional) Restricting Management Rights of the NMS

Procedure

1. Run:

   system-view

   The system view is displayed.

2. Run:

   snmp-agent mib-view { excluded | included } view-name oid-tree

   A MIB view is created, and manageable MIB objects are specified.

   By default, an NMS has right to access the objects in the ViewDefault view.

   You run this command for multiple times, the new configuration overwrites the original configuration if the values of view-name and oid-tree are the same; the new and original configurations both take effect if the values of view-name and oid-tree are different. The system can store a maximum of 20 MIB view configurations, among which there are four default views.

   If both the included and excluded parameters are configured for MIB objects that have an inclusion relationship, whether to include or exclude the lowest MIB object will be determined by the parameter configured for the lowest MIB object. For example, the snmpV2, snmpModules, and snmpUsmMIB objects are from top down in the MIB table. If the excluded parameter is configured for snmpUsmMIB objects and included is configured for snmpV2, snmpUsmMIB objects will still be excluded.

3. Configure NMS filtering based on community name.
   1. (Optional) Configure the basic ACL.

      Before configuring the access control rights, you must create a basic ACL. For the creation procedure, see "ACL Configuration" in the S2700 and S3700 Series Ethernet Switches Configuration Guide-Security.

   2. Run:

      snmp-agent community  { read | write } { community-name | cipher community-name } [ mib-view view-name | acl acl-number ] *

      The NMS's access right are specified.

      By default, the community name has the right of the ViewDefault view.

      • To grant only the read permission to low-level administrators, specify the parameter read. To grant the read and write permissions to high-level administrators, specify the parameter write.

      • To ensure security, use the parameter cipher to configure the community name to be displayed in cipher text. Administrators must keep the community name properly, because they cannot query the community name on the device.

      • If the NMSs using this community name have the right of the ViewDefault view, the parameter mib-view view-name is not required.

      • If all NMSs using this community name manage specified objects on the managed devices, the parameter acl acl-number is not required.

      • If some NMSs using this community name manage specified objects on the managed devices, the parameters acl and mib-view must be configured.

      Before specifying the NMS to manage devices with this community name, check the ACL rule. When the ACL rule is permit, the NMS with the source IP address specified in this rule can access the local device. When the ACL rule is deny, the NMS with the source IP address specified in this rule cannot access the local device.