03-Network Management and Monitoring Command Reference

HomeSupportWirelessH3C WX5500E Series Access ControllersReference GuidesCommand ReferencesH3C WX5540E Access Controller Switching Engine Command References(R2607P26)-6W10103-Network Management and Monitoring Command Reference
04-SNMP commands
Title Size Download
04-SNMP commands 203.71 KB

SNMP commands

display snmp-agent community

Use display snmp-agent community to display SNMPv1 and SNMPv2c community information.

Syntax

display snmp-agent community [ read | write ] [ | { begin | exclude | include } regular-expression ]

Views

Any view

Default command level

1: Monitor level

Parameters

read: Displays information about SNMP read-only communities.

write: Displays information about SNMP read and write communities.

|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide.

begin: Displays the first line that matches the specified regular expression and all lines that follow.

exclude: Displays all lines that do not match the specified regular expression.

include: Displays all lines that match the specified regular expression.

regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.

Usage guidelines

This command displays the SNMPv1 and SNMPv2c communities that you have created using the snmp-agent community command or the snmp-agent usm-user { v1 | v2c } command.

Examples

# Display information about all SNMPv1 and SNMPv2c communities.

<Sysname> display snmp-agent community

   Community name: aa

       Group name: aa

       Acl:2001

       Storage-type: nonVolatile

 

   Community name: bb

       Group name: bb

       Storage-type: nonVolatile

 

   Community name: userv1

       Group name: testv1

       Storage-type: nonVolatile

Table 1 Command output

Field

Description

Community name

Displays the community name created by using the snmp-agent community command or the username created by using the snmp-agent usm-user { v1 | v2c } command.

Group name

SNMP group name:

·       If the community is created by using the snmp-agent community command, the group name is the same as the community name.

·       If the community is created by using the snmp-agent usm-user { v1 | v2c } command, the name of the group to which the user belongs is displayed.

Acl

Number of the ACL that controls the access of the NMSs in the community to the device.

Only the NMSs with the IP addresses permitted in the ACL can access the device with the community name.

Storage-type

Storage type:

·       volatile—Settings are lost when the system reboots.

·       nonVolatile—Settings remain after the system reboots.

·       permanent—Settings remain after the system reboots and can be modified but not deleted.

·       readOnly—Settings remain after the system reboots and cannot be modified or deleted.

·       other—Any other storage type.

 

Related commands

·           snmp-agent community

·           snmp-agent usm-user { v1 | v2c }

display snmp-agent group

Use display snmp-agent group to display information about an SNMP group, including the group name, security model, MIB view, and storage type.

Syntax

display snmp-agent group [ group-name ] [ | { begin | exclude | include } regular-expression ]

Views

Any view

Default command level

1: Monitor level

Parameters

group-name: Specifies an SNMP group name, a case-sensitive string of 1 to 32 characters. You can specify an SNMPv1, SNMPv2c, or SNMPv3 group.

|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide.

begin: Displays the first line that matches the specified regular expression and all lines that follow.

exclude: Displays all lines that do not match the specified regular expression.

include: Displays all lines that match the specified regular expression.

regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.

Usage guidelines

If no group is specified, the command displays information about all SNMP groups.

Examples

# Display information about all SNMP groups.

<Sysname> display snmp-agent group

 

   Group name: groupv1

       Security model: v1 noAuthnoPriv

       Readview: ViewDefault

       Writeview: <no specified>

       Notifyview: <no specified>

       Storage-type: nonVolatile

 

   Group name: groupv3

       Security model: v3 noAuthnoPriv

       Readview: ViewDefault

       Writeview: <no specified>

       Notifyview: <no specified>

       Storage-type: nonVolatile

Table 2 Command output

Field

Description

Group name

SNMP group name.

Security model

Security model of the SNMP group:

·       authPriv—Authentication with privacy.

·       authNoPriv—Authentication without privacy.

·       noAuthNoPriv—No authentication, no privacy.

The security model of an SNMPv1 or SNMPv2c group can only be noAuthNoPriv.

Readview

Read only MIB view accessible to the SNMP group.

Writeview

Write MIB view accessible to the SNMP group.

Notifyview

Notify MIB view for the SNMP group. The SNMP users in the group can send traps only for the nodes in the notify MIB view.

Storage-type

Storage type, including volatile, nonVolatile, permanent, readOnly, and other (see Table 1).

 

Related commands

snmp-agent group

display snmp-agent local-engineid

Use display snmp-agent local-engineid to display the local SNMP engine ID.

Syntax

display snmp-agent local-engineid [ | { begin | exclude | include } regular-expression ]

Views

Any view

Default command level

1: Monitor level

Parameters

|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide.

begin: Displays the first line that matches the specified regular expression and all lines that follow.

exclude: Displays all lines that do not match the specified regular expression.

include: Displays all lines that match the specified regular expression.

regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.

Usage guidelines

The local SNMP engine ID uniquely identifies the SNMP engine of the SNMP agent in an SNMP domain.

Every SNMP agent has one SNMP engine to provide services for sending and receiving messages, authenticating and encrypting messages, and controlling access to managed objects.

Examples

# Display the local engine ID.

<Sysname> display snmp-agent local-engineid

SNMP local EngineID: 800007DB7F0000013859

display snmp-agent mib-view

Use display snmp-agent mib-view to display MIB views.

Syntax

display snmp-agent mib-view [ exclude | include | viewname view-name ] [ | { begin | exclude | include } regular-expression ]

Views

Any view

Default command level

1: Monitor level

Parameters

exclude: Displays the subtrees excluded from any MIB view.

include: Displays the subtrees included in any MIB view.

viewname view-name: Displays information about the specified MIB view.

|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide.

begin: Displays the first line that matches the specified regular expression and all lines that follow.

exclude: Displays all lines that do not match the specified regular expression.

include: Displays all lines that match the specified regular expression.

regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.

Usage guidelines

If you do not specify any parameter, the command displays all MIB views.

Examples

# Display all MIB views.

<Sysname> display snmp-agent mib-view

   View name:ViewDefault

       MIB Subtree:iso

       Subtree mask:

       Storage-type: nonVolatile

       View Type:included

       View status:active

 

   View name:ViewDefault

       MIB Subtree:snmpUsmMIB

       Subtree mask:

       Storage-type: nonVolatile

       View Type:excluded

       View status:active

 

   View name:ViewDefault

       MIB Subtree:snmpVacmMIB

       Subtree mask:

       Storage-type: nonVolatile

       View Type:excluded

       View status:active

 

   View name:ViewDefault

       MIB Subtree:snmpModules.18

       Subtree mask:

       Storage-type: nonVolatile

       View Type:excluded

       View status:active

ViewDefault is the default MIB view. The output shows that except for the MIB objects in the snmpUsmMIB, snmpVacmMIB, and snmpModules.18 subtrees, all the MIB objects in the iso subtree are accessible.

Table 3 Command output

Field

Description

View name

MIB view name.

MIB Subtree

MIB subtree covered by the MIB view.

Subtree mask

MIB subtree mask.

Storage-type

Type of the medium where the subtree view is stored.

View Type

Access privilege for the MIB subtree in the MIB view:

·       IncludedAll objects in the MIB subtree are accessible in the MIB view.

·       ExcludedNone of the objects in the MIB subtree is accessible in the MIB view.

View status

Status of the MIB view.

 

display snmp-agent statistics

Use display snmp-agent statistics to display SNMP message statistics.

Syntax

display snmp-agent statistics [ | { begin | exclude | include } regular-expression ]

Views

Any view

Default command level

1: Monitor level

Parameters

|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide.

begin: Displays the first line that matches the specified regular expression and all lines that follow.

exclude: Displays all lines that do not match the specified regular expression.

include: Displays all lines that match the specified regular expression.

regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.

Examples

# Display SNMP message statistics.

<Sysname> display snmp-agent statistics

  1684 Messages delivered to the SNMP entity

  5 Messages which were for an unsupported version

  0 Messages which used a SNMP community name not known

  0 Messages which represented an illegal operation for the community supplied

  0 ASN.1 or BER errors in the process of decoding

  1679 Messages passed from the SNMP entity

  0 SNMP PDUs which had badValue error-status

  0 SNMP PDUs which had genErr error-status

  0 SNMP PDUs which had noSuchName error-status

  0 SNMP PDUs which had tooBig error-status (Maximum packet size 1500)

  16544 MIB objects retrieved successfully

  2 MIB objects altered successfully

  7 GetRequest-PDU accepted and processed

  7 GetNextRequest-PDU accepted and processed

  1653 GetBulkRequest-PDU accepted and processed

  1669 GetResponse-PDU accepted and processed

  2 SetRequest-PDU accepted and processed

  0 Trap PDUs accepted and processed

  0 Alternate Response Class PDUs dropped silently

  0 Forwarded Confirmed Class PDUs dropped silently

Table 4 Command output

Field

Description

Messages delivered to the SNMP entity

Number of messages that the SNMP agent has received.

Messages which were for an unsupported version

Number of messages that had an SNMP version not configured on the SNMP agent.

Messages which used a SNMP community name not known

Number of messages that had a community name not configured on the SNMP agent.

Messages which represented an illegal operation for the community supplied

Number of messages carrying an operation that the community has no right to perform.

ASN.1 or BER errors in the process of decoding

Number of messages that had ASN.1 or BER errors during decoding.

Messages passed from the SNMP entity

Number of messages sent by the SNMP agent.

SNMP PDUs which had badValue error-status

Number of SNMP PDUs with a badValue error.

SNMP PDUs which had genErr error-status

Number of SNMP PDUs with a genErr error.

SNMP PDUs which had noSuchName error-status

Number of PDUs with a noSuchName error.

SNMP PDUs which had tooBig error-status (Maximum packet size 1500)

Number of PDUs with a tooBig error (the maximum packet size is 1500 bytes).

MIB objects retrieved successfully

Number of MIB objects that have been successfully retrieved.

MIB objects altered successfully

Number of MIB objects that have been successfully modified.

GetRequest-PDU accepted and processed

Number of get requests that have been received and processed.

GetNextRequest-PDU accepted and processed

Number of getNext requests that have been received and processed.

GetBulkRequest-PDU accepted and processed

Number of getBulk requests that have been received and processed.

GetResponse-PDU accepted and processed

Number of get responses that have been received and processed.

SetRequest-PDU accepted and processed

Number of set requests that have been received and processed.

Trap PDUs accepted and processed

Number of traps that have been received and processed.

Alternate Response Class PDUs dropped silently

Number of dropped response packets.

Forwarded Confirmed Class PDUs dropped silently

Number of forwarded packets that have been dropped.

 

display snmp-agent sys-info

Use display snmp-agent sys-info to display the current SNMP system information.

Syntax

display snmp-agent sys-info [ contact | location | version ] * [ | { begin | exclude | include } regular-expression ]

Views

Any view

Default command level

1: Monitor level

Parameters

contact: Displays the system contact.

location: Displays the system location.

version: Displays the SNMP version of the SNMP agent.

|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide.

begin: Displays the first line that matches the specified regular expression and all lines that follow.

exclude: Displays all lines that do not match the specified regular expression.

include: Displays all lines that match the specified regular expression.

regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.

Usage guidelines

If you do not specify any keyword, the command displays all SNMP agent system information.

Examples

# Display SNMP agent system information.

<Sysname> display snmp-agent sys-info

   The contact person for this managed node:

           Hangzhou H3C Technologies Co., Ltd.

 

   The physical location of this node:

           Hangzhou, China

 

   SNMP version running in the system:

           SNMPv3

display snmp-agent trap queue

Use display snmp-agent trap queue to display basic information about the trap queue, including the trap queue name, queue length, and number of traps in the queue.

Syntax

display snmp-agent trap queue [ | { begin | exclude | include } regular-expression ]

Views

Any view

Default command level

1: Monitor level

Parameters

|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide.

begin: Displays the first line that matches the specified regular expression and all lines that follow.

exclude: Displays all lines that do not match the specified regular expression.

include: Displays all lines that match the specified regular expression.

regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.

Examples

# Display the trap queue configuration and usage status.

<Sysname> display snmp-agent trap queue

   Queue name: SNTP

   Queue size: 100

   Message number: 6

Table 5 Command output

Field

Description

Queue name

Trap queue name.

Queue size

Trap queue size.

Message number

Number of traps in the current trap queue.

 

Related commands

·           snmp-agent trap life

·           snmp-agent trap queue-size

display snmp-agent trap-list

Use display snmp-agent trap-list to display modules that can generate traps and their trap status (enable or disable).

Syntax

display snmp-agent trap-list [ | { begin | exclude | include } regular-expression ]

Views

Any view

Default command level

1: Monitor level

Parameters

|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide.

begin: Displays the first line that matches the specified regular expression and all lines that follow.

exclude: Displays all lines that do not match the specified regular expression.

include: Displays all lines that match the specified regular expression.

regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.

Usage guidelines

You can use the snmp-agent trap enable command to enable or disable the trap function of a module. For a module that has multiple sub-modules, the trap status is enable if the trap function of any of its sub-modules is enabled.

Examples

# Display the modules that can generate traps and their trap status.

<Sysname> display snmp-agent trap-list

   acfp trap enable

   bfd trap enable

   configuration trap enable

   default-route trap enable

   flash trap enable

   standard trap enable

   system trap enable

 

   Enable traps: 12; Disable traps: 0

Related commands

snmp-agent trap enable

display snmp-agent usm-user

Use display snmp-agent usm-user to display SNMPv3 user information.

Syntax

display snmp-agent usm-user [ engineid engineid | username user-name | group group-name ] * [ | { begin | exclude | include } regular-expression ]

Views

Any view

Default command level

1: Monitor level

Parameters

engineid engineid: Displays SNMPv3 user information for the SNMP engine ID identified by engineid. When an SNMPv3 user is created, the system records the local SNMP entity engine ID. The user becomes invalid when the engine ID changes and becomes valid again when the recorded engine ID is restored.

username user-name: Displays information about the specified SNMPv3 user. The username is case-sensitive.

group group-name: Displays SNMPv3 user information for an SNMP group. The group name is case-sensitive.

|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide.

begin: Displays the first line that matches the specified regular expression and all lines that follow.

exclude: Displays all lines that do not match the specified regular expression.

include: Displays all lines that match the specified regular expression.

regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.

Usage guidelines

This command displays only SNMPv3 users that you have created by using the snmp-agent usm-user v3 command. To display SNMPv1 or SNMPv2c users created by using the snmp-agent usm-user { v1 | v2c } command, use the display snmp-agent community command.

Examples

# Display information about SNMPv3 users.

<Sysname> display snmp-agent usm-user

   User name: userv3

   Group name: mygroupv3

       Engine ID: 800063A203000FE240A1A6

       Storage-type: nonVolatile

       UserStatus: active

 

   User name: userv3code

   Group name: groupv3code

       Engine ID: 800063A203000FE240A1A6

       Storage-type: nonVolatile

       UserStatus: active

Table 6 Command output

Field

Description

User name

SNMP username.

Group name

SNMP group name.

Engine ID

Engine ID for an SNMP entity.

Storage-type

Storage type:

·       volatile.

·       nonvolatile.

·       permanent.

·       readOnly.

·       other.

For more information about these storage types, see Table 1.

UserStatus

SNMP user status.

 

Related commands

snmp-agent usm-user v3

enable snmp trap updown

Use enable snmp trap updown to enable link state traps on an interface.

Use undo enable snmp trap updown to disable link state traps on an interface.

Syntax

enable snmp trap updown

undo enable snmp trap updown

Default

Link state traps are enabled.

Views

Layer 2 Ethernet interface view, VLAN interface view

Default command level

2: System level

Usage guidelines

For an interface to generate linkUp/linkDown traps when its state changes, you must also enable the linkUp/linkDown trap function globally using the enable snmp trap updown command.

Examples

# Enable port GigabitEthernet 1/0/1 to send linkUp/linkDown SNMP traps to 10.1.1.1 in the community public.

<Sysname> system-view

[Sysname] snmp-agent trap enable

[Sysname] snmp-agent target-host trap address udp-domain 10.1.1.1 params securityname public

[Sysname] interface GigabitEthernet1/0/1

[Sysname-GigabitEthernet1/0/1] enable snmp trap updown

Related commands

·           snmp-agent target-host

·           snmp-agent trap enable

snmp-agent

Use snmp-agent to enable the SNMP agent.

Use undo snmp-agent to disable the SNMP agent.

Syntax

snmp-agent

undo snmp-agent

Default

The SNMP agent is disabled.

Views

System view

Default command level

3: Manage level

Usage guidelines

The snmp-agent command is optional for an SNMP configuration task. The SNMP agent is automatically enabled when you execute any command that begins with snmp-agent except for the snmp-agent calculate-password and snmp-agent ifmib long-ifindex enable commands.

Examples

# Enable the SNMP agent.

<Sysname> system-view

[Sysname] snmp-agent

snmp-agent calculate-password

Use snmp-agent calculate-password to convert a plaintext key to an encrypted key for authentication or encryption in SNMPv3.

Syntax

snmp-agent calculate-password plain-password mode { 3desmd5 | 3dessha | md5 | sha } { local-engineid | specified-engineid engineid }

Views

System view

Default command level

3: Manage level

Parameters

plain-password: Specifies a plaintext authentication or privacy key.

mode: Specifies authentication and privacy algorithms. Select a mode option, depending on the authentication and privacy algorithm you are configuring with the snmp-agent usm-user v3 command. The three privacy algorithms Advanced Encryption Standard (AES), Triple Data Encryption Standard (3DES), and Data Encryption Standard (DES) are in descending order of security strength. Higher security means more complex implementation mechanism and lower speed. DES is enough to meet general requirements. The Message-Digest Algorithm 5 (MD5) and Secure Hash Algorithm (SHA-1) are the two authentication algorithms. MD5 is faster but less secure than SHA-1. For more information about these algorithms, see Security Configuration Guide.

·           3desmd5: Converts the plaintext privacy key to an encrypted key for 3DES encryption used together with MD5 authentication.

·           3dessha: Converts the plaintext privacy key to an encrypted key for 3DES encryption used together with SHA-1 authentication.

·           md5: Converts the plaintext authentication key to an encrypted key for MD5 authentication, or converts the plaintext privacy key to an encrypted key for AES or DES encryption used in conjunction with MD5.

·           sha: Converts the plaintext authentication key to an encrypted key for SHA-1 authentication, or converts the plaintext privacy key to an encrypted key for AES or DES encryption used in conjunction with SHA-1 authentication.

local-engineid: Uses the local engine ID to calculate the encrypted key. For engine ID-related configuration, see the snmp-agent local-engineid command.

specified-engineid: Uses a user-defined engine ID to calculate the encrypted key.

engineid: Specifies an SNMP engine ID as a hexadecimal string. It must comprise an even number of hexadecimal characters, in the range of 10 to 64. All-zero and all-F strings are invalid.

Usage guidelines

This command helps you calculate encrypted authentication and privacy keys for SNMPv3 users that use encrypted authentication and privacy keys. To create an SNMPv3 user, see the snmp-agent usm-user v3 command.

Make sure the SNMP agent is enabled before you execute the snmp-agent calculate-password command.

The converted key is valid only under the engine ID specified for key conversion.

Examples

# Use the local engine and the MD5 algorithm to convert the plaintext key authkey to an encrypted key.

<Sysname> system-view

[Sysname] snmp-agent calculate-password authkey mode md5 local-engineid

The secret key is: 09659EC5A9AE91BA189E5845E1DDE0CC

Related commands

snmp-agent usm-user v3

snmp-agent community

Use snmp-agent community to configure an SNMP community.

Use undo snmp-agent community to delete an SNMP community.

Syntax

snmp-agent community { read | write } [ cipher ] community-name [ mib-view view-name ] [ acl acl-number ]

undo snmp-agent community { read | write } [ cipher ] community-name

Views

System view

Default command level

3: Manage level

Parameters

read: Assigns the specified community the read only access to MIB objects. A read-only community can only inquire MIB information.

write: Assigns the specified community the read and write access to MIB objects. A read and write community can configure MIB information.

cipher: Sets a ciphertext community name and saves it in cipher text. To set and save a community name in plain text, do not specify this keyword.

community-name: Sets a community name. If it is configured in plain text, it must be a string of 1 to 32 characters. If it is configured in cipher text, it must be a string of 1 to 73 characters.

mib-view view-name: Specifies the MIB view available for the community. The view-name argument represents a MIB view name, a string of 1 to 32 characters. A MIB view represents a set of accessible MIB objects. If no MIB view is specified, the specified community can access the MIB objects in the default MIB view ViewDefault. To create a MIB view, use the snmp-agent mib-view command.

acl acl-number: Specifies a basic ACL to filter NMSs by source IP address. The acl-number argument represents a basic ACL number in the range of 2000 to 2999. In the specified community, only the NMSs with the IP addresses permitted in the ACL can access the SNMP agent.

Usage guidelines

This command is for SNMPv1 and SNMPv2c.

A community comprises NMSs and SNMP agents, and is identified by a community name. When devices in a community communicate with each other, they use the community name for authentication. An NMS and an SNMP agent can access each other only when they are configured with the same community name. Typically, public is used as the read-only community name, and private is used as the read and write community name. To improve security, assign your SNMP communities a name other than public and private.

To make sure the MIB objects are accessible only to a specific NMS, use a basic ACL to identify the source IP address of the NMS. To set the range of the MIB objects available for the community, use a MIB view.

Examples

# Create the read-only community readaccess so an NMS can use the protocol SNMPv1 or SNMPv2c and community name readaccess to read the MIB objects in the default view ViewDefault.

<Sysname> system-view

[Sysname] snmp-agent sys-info version v1 v2c

[Sysname] snmp-agent community read readaccess

# Create the read and write community writeaccess so only the host at 1.1.1.1 can use the protocol SNMPv2c and community name writeaccess to read and set the MIB objects in the default view ViewDefault.

<Sysname> system-view

[Sysname] acl number 2001

[Sysname-acl-basic-2001] rule permit source 1.1.1.1 0.0.0.0

[Sysname-acl-basic-2001] rule deny source any

[Sysname-acl-basic-2001] quit

[Sysname] snmp-agent sys-info version v2c

[Sysname] snmp-agent community write writeaccess acl 2001

# Create the read and write community wr-sys-acc so an NMS can use the protocol SNMPv1 or SNMPv2c, community name wr-sys-acc to read and set the MIB objects in the system subtree (OID 1.3.6.1.2.1.1).

<Sysname> system-view

[Sysname] snmp-agent sys-info version v1 v2c

[Sysname] undo snmp-agent mib-view ViewDefault

[Sysname] snmp-agent mib-view included test system

[Sysname] snmp-agent community write wr-sys-acc mib-view test

Related commands

snmp-agent mib-view

snmp-agent group

Use snmp-agent group to create an SNMP group and specify its access right.

Use undo snmp-agent group to delete an SNMP group.

Syntax

SNMPv1 and SNMP v2c:

snmp-agent group { v1 | v2c } group-name [ read-view view-name ] [ write-view view-name ] [ notify-view view-name ] [ acl acl-number ]

undo snmp-agent group { v1 | v2c } group-name

SNMPv3:

snmp-agent group v3 group-name [ authentication | privacy ] [ read-view view-name ] [ write-view view-name ] [ notify-view view-name ] [ acl acl-number ]

undo snmp-agent group v3 group-name [ authentication | privacy ]

Default

No SNMP group exists. SNMPv3 groups use the no authentication, no privacy security model if neither authentication nor privacy is specified.

Views

System view

Default command level

3: Manage level

Parameters

v1: Specifies SNMPv1.

v2c: Specifies SNMPv2c.

v3: Specifies SNMPv3.

group-name: Group name, a string of 1 to 32 characters.

authentication: Specifies the security model of the SNMPv3 group to be authentication only (without privacy).

privacy: Specifies the security model of the SNMPv3 group to be authentication and privacy.

read-view view-name: Specifies a read-only MIB view. The view-name represents a MIB view, a string of 1 to 32 characters. The users in the specified group have read only access to the objects included in the MIB view. The default read view is ViewDefault.

write-view view-name: Specifies a read and write MIB view. The view-name argument represents a MIB view, a string of 1 to 32 characters. The users in the specified group have read and write access to the objects included in the MIB view. By default, no write view is configured, which means the NMS cannot perform the write operations to all MIB objects on the device.

notify-view view-name: Specifies a trap MIB view. The view-name argument represents a MIB view, a string of 1 to 32 characters. The system sends traps to the users in the specified group for the objects included in the MIB view. By default, no notify view is configured, which means the agent does not send traps to the NMS.

acl acl-number: Specifies a basic ACL to filter NMSs by source IPv4 address. The acl-number argument represents a basic ACL number in the range of 2000 to 2999. In the specified SNMP group, only the NMSs with the IP addresses permitted in the ACL can access the SNMP agent.

Usage guidelines

All the users in an SNMP group share the security model and access rights of the group.

Examples

# Create the SNMPv3 group group1 and assign the no authentication, no privacy security model to the group.

<Sysname> system-view

[Sysname] snmp-agent group v3 group1

Related commands

·           snmp-agent mib-view

·           snmp-agent usm-user

snmp-agent local-engineid

Use snmp-agent local-engineid to configure the SNMP engine ID of the local SNMP agent.

Use undo snmp-agent local-engineid to restore the default local SNMP engine ID.

Syntax

snmp-agent local-engineid engineid

undo snmp-agent local-engineid

Default

The local engine ID is the combination of the company ID and the device ID. Device ID varies by product and might be an IP address, a MAC address, or a user-defined hexadecimal string.

Views

System view

Default command level

3: Manage level

Parameters

engineid: Specifies an SNMP engine ID as a hexadecimal string. It must comprise an even number of hexadecimal characters, in the range of 10 to 64. All-zero and all-F strings are invalid.

Usage guidelines

An SNMP engine ID uniquely identifies an SNMP entity in an SNMP managed network. Make sure the local SNMP engine ID is unique within your SNMP managed network to avoid communication problems.

If you have configured SNMPv3 users, change the local SNMP engine ID only if necessary. The change can void the SNMPv3 usernames and encrypted keys you have configured.

Examples

# Configure the local engine ID as 123456789A.

<Sysname> system-view

[Sysname] snmp-agent local-engineid 123456789A

Related commands

snmp-agent usm-user

snmp-agent log

Use snmp-agent log to enable SNMP logging.

Use undo snmp-agent log to restore the default.

Syntax

snmp-agent log { all | get-operation | set-operation }

undo snmp-agent log { all | get-operation | set-operation }

Default

SNMP logging is disabled.

Views

System view

Default command level

3: Manage level

Parameters

all: Enables logging SNMP GET and SET operations.

get-operation: Enables logging SNMP GET operations.

set-operation: Enables logging SNMP SET operations.

Usage guidelines

Use SNMP logging to record the SNMP operations performed on the SNMP agent for auditing NMS behaviors. The SNMP agent sends log data to the information center. You can configure the information center to output the data to a specific destination as needed.

Examples

# Enable logging SNMP GET operations.

<Sysname> system-view

[Sysname] snmp-agent log get-operation

# Enable logging SNMP SET operations.

<Sysname> system-view

[Sysname] snmp-agent log set-operation

snmp-agent ifmib long-ifindex enable

Use snmp-agent ifmib long-ifindex enable to switch the format of an NM-specific ifindex from 16-bit to 32-bit.

Use undo snmp-agent ifmib long-ifindex enable to restore the default.

Syntax

snmp-agent ifmib long-ifindex enable

undo snmp-agent ifmib long-ifindex enable

Default

An NM-specific ifindex is in 16-bit format.

Views

System view

Default command level

2: System level

Usage guidelines

Some configurations use parameters relating to NM-specific ifindex. An NM-specific ifindex format change invalidates the NM-specific ifindex dependent settings, and these settings cannot become valid until you switch the format back. To use these settings in the new format, you must re-configure them. For example, if an RMON alarm group or private alarm group has alarm variables in the format OID/variable-name.NM-specific-ifindex, you must reconfigure these variables after an NM-specific ifindex format change.

Examples

# Switch the format of an NM-specific ifindex from 16-bit to 32-bit.

<Sysname> system-view

[Sysname] snmp-agent ifmib long-ifindex enable

snmp-agent mib-view

Use snmp-agent mib-view to create or update a MIB view.

Use undo snmp-agent mib-view to delete a MIB view.

Syntax

snmp-agent mib-view { excluded | included } view-name oid-tree [ mask mask-value ]

undo snmp-agent mib-view view-name

Default

The system creates the ViewDefault view when the SNMP agent is enabled. In the default MIB view, all MIB objects in the iso subtree but the snmpUsmMIB, snmpVacmMIB, and snmpModules.18 subtrees are accessible.

Views

System view

Default command level

3: Manage level

Parameters

excluded: Denies access to any node in the specified MIB subtree.

included: Permits access to the nodes in the specified MIB subtree.

view-name: Specifies a view name, a string of 1 to 32 characters.

oid-tree: Specifies a MIB subtree by its root node's OID (for example 1.4.5.3.1) or object name (for example, system). An OID is a dotted numeric string that uniquely identifies an object in the MIB tree.

mask mask-value: Sets a MIB subtree mask, a hexadecimal string. Its length must be an even number in the range of 2 to 32. For example, you can specify 0a, aa, but not 0aa. If no subtree mask is specified, the MIB subtree mask is an all-F hexadecimal string. The MIB subtree and the subtree mask together identify a set of objects to be included or excluded from the view.

Usage guidelines

A MIB view represents a set of MIB objects (or MIB object hierarchies) with certain access privilege. The MIB objects included in the MIB view are accessible while those excluded from the MIB view are inaccessible.

Each view-name oid-tree pair represents a view record. If you specify the same record with different MIB subtree masks multiple times, the last configuration takes effect.

The system can store entries for up to 20 unique MIB view records. In addition to the four default MIB view records, you can create up to 16 unique MIB view records. After you delete the default view with the undo snmp-agent mib-view command, you can create up to 20 unique MIB view records.

Be cautious with deleting the default MIB view. The operation blocks access to any MIB object on the device from NMSs that use the default view.

Examples

# Include the mib-2 (OID 1.3.6.1) subtree in the mibtest view and exclude the ip subtree from this view.

<Sysname> system-view

[Sysname] snmp-agent mib-view included mibtest 1.3.6.1

[Sysname] snmp-agent mib-view excluded mibtest ip

[Sysname] snmp-agent community read public mib-view mibtest

An SNMPv1 NMS in the public community can query the objects in the mib-2 subtree, but not any object (for example, the ipForwarding or ipDefaultTTL node) in the ip subtree.

Related commands

·           snmp-agent community

·           snmp-agent group

snmp-agent packet max-size

Use snmp-agent packet max-size to set the maximum size (in bytes) of SNMP packets that the SNMP agent can receive or send.

Use undo snmp-agent packet max-size to restore the default packet size.

Syntax

snmp-agent packet max-size byte-count

undo snmp-agent packet max-size

Default

The maximum size of SNMP packets is 1500 bytes.

Views

System view

Default command level

3: Manage level

Parameters

byte-count: Specifies the maximum size (in bytes) of SNMP packets that the SNMP agent can receive or send. The value range is 484 to 17940, and the default is 1500.

Usage guidelines

If any device on the path to the NMS does not support packet fragmentation, limit the SNMP packet size to prevent large-sized packets from being discarded. For most networks, the default value is sufficient.

Examples

# Set the maximum SNMP packet size to 1024 bytes.

<Sysname> system-view

[Sysname] snmp-agent packet max-size 1024

snmp-agent packet response dscp

Use snmp-agent packet response dscp to set the DSCP value for SNMP responses.

Use undo snmp-agent packet response dscp to restore the default.

Syntax

snmp-agent packet response dscp dscp-value

undo snmp-agent packet response dscp

Default

The DSCP value for SNMP responses is 0.

Views

System view

Default command level

3: Manage level

Parameters

dscp-value: Specifies the DSCP value for SNMP responses, in the range of 0 to 63.

Examples

# Set the DSCP value to 45 for SNMP responses.

<Sysname> system-view

[Sysname] snmp-agent packet response dscp 45

snmp-agent sys-info

Use snmp-agent sys-info to configure system information for the SNMP agent, including the contact, location, and SNMP versions.

Use undo snmp-agent sys-info contact and undo snmp-agent sys-info location to restore the default.

Use undo snmp-agent sys-info version to disable an SNMP version.

Syntax

snmp-agent sys-info { contact sys-contact | location sys-location | version { all | { v1 | v2c | v3 }* } }

undo snmp-agent sys-info { contact | location | version { all | { v1 | v2c | v3 }* } }

Default

The contact is Hangzhou H3C Tech. Co., Ltd., the location is Hangzhou, China, and the SNMP version is SNMPv3.

Views

System view

Default command level

3: Manage level

Parameters

contact sys-contact: Specifies the system contact, a string of 1 to 200 characters.

location sys-location: Specifies the system location, a string of 1 to 200 characters.

version: Specifies SNMP versions.

·           all: Specifies SNMPv1, SNMPv2c, and SNMPv3.

·           v1: Specifies SNMPv1.

·           v2c: Specifies SNMPv2c.

·           v3: Specifies SNMPv3.

Usage guidelines

Configure the SNMP agent with the same SNMP version as the NMS for successful communications between them.

Examples

# Configure the system contact as Dial System Operator at beeper # 27345.

<Sysname> system-view

[Sysname] snmp-agent sys-info contact Dial System Operator at beeper # 27345

snmp-agent target-host

Related commands

display snmp-agent sys-info

snmp-agent target-host

Use snmp-agent target-host to configure a target host for receiving traps sent by the SNMP agent.

Use undo snmp-agent target-host to remove settings for an SNMP trap target host.

Syntax

snmp-agent target-host trap address udp-domain ip-address [ udp-port port-number ] [ dscp dscp-value ] params securityname security-string [ v1 | v2c | v3 [ authentication | privacy ] ]

undo snmp-agent target-host trap address udp-domain ip-address params securityname security-string

Views

System view

Default command level

3: Manage level

Parameters

trap: Specifies a target host for receiving the traps sent by the device.

address: Specifies the IP address of the target host.

udp-domain: Specifies UDP as the transport protocol.

ip-address: Specifies the IPv4 address or name of the target host. The host name is a string of 1 to 255 characters.

udp-port port-number: Specifies the UDP port for receiving SNMP traps. The default UDP port is 162.

dscp dscp-value: Sets the DSCP value for SNMP traps, in the range of 0 to 63. The default DSCP is 0.

params securityname security-string: Specifies the authentication parameter. The security-string argument specifies an SNMPv1 or SNMPv2c community name or an SNMPv3 username, a string of 1 to 32 characters.

v1: Specifies SNMPv1.

v2c: Specifies SNMPv2c.

v3: Specifies SNMPv3.

·           authentication: Specifies the security model to be authentication without privacy. You must specify the authentication key when you create the SNMPv3 user.

·           privacy: Specifies the security model to be authentication with privacy. You must specify the authentication key and privacy key when you create the SNMPv3 user.

Usage guidelines

Make sure the SNMP agent uses the same UDP port number as the target host for traps. If udp-port port-number is not specified, UDP port 162 is used by default. Port 162 is the SNMP-specified port used for receiving traps, and is used by most NMSs, including IMC and MIB Browser.

Make sure the SNMP agent uses the same SNMP version as the trap host so the host can receive traps. If none of the keywords v1, v2c , or v3 is specified, SNMPv1 is used.

If neither authentication nor privacy is specified, the authentication mode is no authentication, no privacy.

Examples

# Configure the SNMP agent to send SNMPv1 traps to 10.1.1.1 in the community public.

<Sysname> system-view

[Sysname] snmp-agent trap enable standard

[Sysname] snmp-agent target-host trap address udp-domain 10.1.1.1 params securityname public

Related commands

·           enable snmp trap updown

·           snmp-agent trap enable

·           snmp-agent trap life

·           snmp-agent trap source

snmp-agent trap enable

Use snmp-agent trap enable to enable traps globally.

Use undo snmp-agent trap enable to disable traps globally.

Syntax

snmp-agent trap enable [ acfp [ client | policy | rule | server ] | arp rate-limit | configuration | default-route | flash | standard [ authentication | coldstart | linkdown | linkup | warmstart ] * | system ]

undo snmp-agent trap enable [ acfp [ client | policy | rule | server ] | arp rate-limit | configuration | default-route | flash | standard [ authentication | coldstart | linkdown | linkup | warmstart ] * | system ]

Default

Traps are enabled.

Views

System view

Default command level

3: Manage level

Parameters

acfp: Enables SNMP traps for the ACFP module.

·           client: ACFP client traps.

·           policy: ACFP policy traps.

·           rule: ACFP rule traps.

·           server: ACFP server traps.

arp rate-limit: Enables ARP rate limit traps, which are sent when the ARP packet rate exceeds the rate limit.

configuration: Enables configuration traps.

default-route: Enables default route traps, which are sent when default routes are deleted.

flash: Enables Flash-related SNMP traps.

standard: Standard traps.

·           authentication: Enables sending authentication failure traps in the event of authentication failure.

·           coldstart: Sends coldstart traps when the device restarts.

·           linkdown: Globally enables sending linkDown traps when the link of a port goes down.

·           linkup: Globally enables sending linkUp traps when the link of a port goes up.

·           warmstart: Sends warmstart traps when the SNMP restarts.

system: Enables system event (private MIB) traps.

Usage guidelines

After you globally enable a trap function for a module, whether the module generates traps also depends on the configuration of the module. For more information, see the sections for each module.

To generate linkUp or linkDown traps when the link state of an interface changes, you must enable the linkUp or linkDown trap function globally by using the snmp-agent trap enable [ standard [ linkdown | linkup ] * ] command and on the interface by using the enable snmp trap updown command.

Examples

# Enable the SNMP agent to send SNMP authentication failure traps to 10.1.1.1 in the community public.

<Sysname> system-view

[Sysname] snmp-agent target-host trap address udp-domain 10.1.1.1 params securityname public

[Sysname] snmp-agent trap enable standard authentication

Related commands

·           snmp-agent target-host

·           enable snmp trap updown

snmp-agent trap if-mib link extended

Use snmp-agent trap if-mib link extended to configure the SNMP agent to send extended linkUp/linkDown traps.

Use undo snmp-agent trap if-mib link extended to restore the default.

Syntax

snmp-agent trap if-mib link extended

undo snmp-agent trap if-mib link extended

Default

The SNMP agent sends standard linkUp/linkDown traps.

Views

System view

Default command level

3: Manage level

Usage guidelines

The extended linkUp and linkDown traps add interface description and interface type to the standard linkUp and linkDown traps for fast failure point identification. When you configure the snmp-agent trap if-mib link extended command, make sure the NMS supports the extended linkUp and linkDown traps.

·           A standard linkUp trap is in the following format:

#Apr 24 11:48:04:896 2013 Sysname IFNET/4/INTERFACE UPDOWN:

 Trap 1.3.6.1.6.3.1.1.5.4<linkUp>: Interface 983555 is Up, ifAdminStatus is 1, ifOperStatus is 1

·           An extended linkUp trap is in the following format:

#Apr 24 11:43:09:896 2013 Sysname IFNET/4/INTERFACE UPDOWN:

 Trap 1.3.6.1.6.3.1.1.5.4<linkUp>: Interface 983555 is Up, ifAdminStatus is 1, ifOperStatus is 1, ifDescr is GigabitEthernet1/0/1, ifType is 6

·           A standard linkDown trap is in the following format:

#Apr 24 11:47:35:224 2013 Sysname IFNET/4/INTERFACE UPDOWN:

 Trap 1.3.6.1.6.3.1.1.5.3<linkDown>: Interface 983555 is Down, ifAdminStatus is 2, ifOperStatus is 2 

·           An extended linkDown trap is in the following format:

#Apr 24 11:42:54:314 2013 Sysname IFNET/4/INTERFACE UPDOWN:

 Trap 1.3.6.1.6.3.1.1.5.3<linkDown>: Interface 983555 is Down, ifAdminStatus is 2, ifOperStatus is 2, ifDescr is GigabitEthernet1/0/1, ifType is 6

When this command is configured, the device sends extended linkUp/linkDown traps. If the extended messages are not supported on NMS, the device may not be able to resolve the messages.

Examples

# Extend standard linkUp/linkDown traps.

<Sysname> system-view

[Sysname] snmp-agent trap if-mib link extended

snmp-agent trap life

Use snmp-agent trap life to configure the holding time of the traps in the queue.

Use undo snmp-agent trap life to restore the default holding time of traps in the queue.

Syntax

snmp-agent trap life seconds

undo snmp-agent trap life

Default

The holding time of SNMP traps in the queue is 120 seconds.

Views

System view

Default command level

3: Manage level

Parameters

seconds: Specifies the timeout time, in the range of 1 to 2592000 seconds.

Usage guidelines

The SNMP module sends traps in queues. As soon as the traps are saved in the trap queue, a timer is started. If traps are not sent out until the timer times out (in other words, the holding time configured by using this command expires), the system removes the traps from the trap sending queue.

Examples

# Configure the holding time of traps in the queue as 60 seconds.

<Sysname> system-view

[Sysname] snmp-agent trap life 60

Related commands

·           snmp-agent trap enable

·           snmp-agent target-host

snmp-agent trap queue-size

Use snmp-agent trap queue-size to set the size of the trap sending queue.

Use undo snmp-agent trap queue-size to restore the default queue size.

Syntax

snmp-agent trap queue-size size

undo snmp-agent trap queue-size

Default

Up to 100 traps can be stored in the trap sending queue.

Views

System view

Default command level

3: Manage level

Parameters

size: Specifies the number of traps that can be stored in the trap sending queue, in the range of 1 to 1000.

Usage guidelines

Traps are saved into the trap sending queue when generated. The size of the queue determines the maximum number of the traps that can be stored in the queue. When the size of the trap sending queue reaches the configured value, the newly generated traps are saved into the queue, and the earliest ones are discarded.

Examples

# Set the maximum number of traps that can be stored in the trap sending queue to 200.

<Sysname> system-view

[Sysname] snmp-agent trap queue-size 200

Related commands

·           snmp-agent target-host

·           snmp-agent trap enable

·           snmp-agent trap life

snmp-agent trap source

Use snmp-agent trap source to specify the source IP address contained in the trap.

Use undo snmp-agent trap source to restore the default.

Syntax

snmp-agent trap source interface-type interface-number

undo snmp-agent trap source

Default

SNMP chooses the IP address of an interface to be the source IP address of the trap.

Views

System view

Default command level

3: Manage level

Parameters

interface-type interface-number: Specifies the interface type and interface number.

Usage guidelines

Upon executing this command, the system uses the primary IP address of the specified interface as the source IP address of the traps, and the NMS uses this IP address to uniquely identify the agent. Even if the agent sends out traps through different interfaces, the NMS uses this IP address to filter all traps sent from the agent.

Before you can configure the IP address of a particular interface as the source IP address of the trap, make sure the interface already exists and that it has a legal IP address. If the configured interface does not exist, the configuration fails. If the specified IP address is illegal, the configuration becomes invalid. When a legal IP address is configured for the interface, the configuration automatically becomes valid.

Examples

# Specify the IP address of Vlan-interface 1 as the source address for traps.

<Sysname> system-view

[Sysname] snmp-agent trap source Vlan-interface1

Related commands

·           snmp-agent target-host

·           snmp-agent trap enable

snmp-agent usm-user { v1 | v2c }

Use snmp-agent usm-user { v1 | v2c } to add a user to an SNMPv1 or SNMPv2c group.

Use undo snmp-agent usm-user { v1 | v2c } to delete a user from an SNMPv1 or SNMPv2c group.

Syntax

snmp-agent usm-user { v1 | v2c } user-name group-name [ acl acl-number ]

undo snmp-agent usm-user { v1 | v2c } user-name group-name

Views

System view

Default command level

3: Manage level

Parameters

v1: Specifies SNMPv1.

v2c: Specifies SNMPv2c.

user-name: Specifies a username, a case-sensitive string of 1 to 32 characters.

group-name: Specifies a group name, a case-sensitive string of 1 to 32 characters.

acl acl-number: Specifies a basic ACL to filter NMSs by source IPv4 address. The acl-number argument represents a basic ACL number in the range of 2000 to 2999. Only the NMSs with the IPv4 addresses permitted in the ACL can use the specified username (community name) to access the SNMP agent.

Usage guidelines

Make sure you have created the SNMPv1 or SNMPv2c group.

When you create an SNMPv1 or SNMPv2c user, the system automatically creates a read-only community that has the same name as the SNMPv1 or SNMPv2c username. To change the access right of this community to write access, use the snmp-agent community command or the snmp-agent group { v1 | v2c } command. To display the SNMPv1 and SNMPv2c communities created in this way, use the display snmp-agent community command.

The snmp-agent usm-user { v1 | v2c } command enables managing SNMPv1 and SNMPv2c users in the same way as managing SNMPv3 users. It does not affect the way of configuring SNMPv1 and SNMPv2c communities on the NMS.

Examples

# Add the user userv2c to the SNMPv2c group readCom so an NMS can use the protocol SNMPv2c and the read-only community name userv2c to access the SNMP agent.

<Sysname> system-view

[Sysname] snmp-agent sys-info version v2c

[Sysname] snmp-agent group v2c readCom

[Sysname] snmp-agent usm-user v2c userv2c readCom

# Add the user userv2c in the SNMPv2c group readCom so only the NMS at 1.1.1.1 can use the protocol SNMPv2c and read-only community name userv2c to access the SNMP agent.

<Sysname> system-view

[Sysname] acl number 2001

[Sysname-acl-basic-2001] rule permit source 1.1.1.1 0.0.0.0

[Sysname-acl-basic-2001] rule deny source any

[Sysname-acl-basic-2001] quit

[Sysname] snmp-agent sys-info version v2c

[Sysname] snmp-agent group v2c readCom

[Sysname] snmp-agent usm-user v2c userv2c readCom acl 2001

Related commands

·           display snmp-agent community

·           snmp-agent group

snmp-agent usm-user v3

Use snmp-agent usm-user v3 to add an SNMPv3 user to an SNMP group.

Use undo snmp-agent usm-user v3 to delete an SNMPv3 user from an SNMP group.

Syntax

snmp-agent usm-user v3 user-name group-name [ cipher ] [ authentication-mode { md5 | sha } auth-password [ privacy-mode { 3des | aes128 | des56 } priv-password ] ] [ acl acl-number ]

undo snmp-agent usm-user v3 user-name group-name { local | engineid engineid-string }

Views

System view

Default command level

3: Manage level

Parameters

user-name: Specifies a username, a case-sensitive string of 1 to 32 characters.

group-name: Specifies a group name, a case-sensitive string of 1 to 32 characters.

cipher: Sets ciphertext authentication and privacy keys. If you do not specify this keyword, auth-password and priv-password must be plaintext keys. To obtain the hexadecimal ciphertext for a key, use the snmp-agent calculate-password command.

authentication-mode: Specifies an authentication algorithm. MD5 is faster but less secure than SHA. For more information about these algorithms, see Security Configuration Guide.

·           md5: Specifies the MD5 authentication algorithm.

·           sha: Specifies the SHA-1 authentication algorithm.

auth-password: Specifies a case-sensitive authentication key. If cipher is not specified, it must be a plaintext string of 1 to 64 characters. If cipher is specified, the ciphertext key length requirements differ by authentication algorithm and key string format, as shown in Table 7.

Table 7 Encrypted authentication key length requirements

Authentication algorithm

Hexadecimal string

Non-hexadecimal string

MD5

32 characters

53 characters

SHA

40 characters

57 characters

 

privacy-mode: Specifies an encryption algorithm for privacy. The three encryption algorithms AES, 3DES, and DES are in descending order of security. Higher security means more complex implementation mechanism and lower speed. DES is enough to meet general requirements. For more information about these algorithms, see Security Configuration Guide.

·           3des: Specifies the 3DES algorithm.

·           des56: Specifies the DES algorithm.

·           aes128: Specifies the AES algorithm.

priv-password: Specifies a case-sensitive plaintext or encrypted privacy key. A plaintext key is a string of 1 to 64 characters. If the cipher keyword is specified, the encrypted privacy key length requirements differ by authentication algorithm and key string format, as shown in Table 8.

Table 8 Encrypted privacy key length requirements

Authentication algorithm

Encryption algorithm

Hexadecimal string

Non-hexadecimal string

MD5

3DES

64 characters

73 characters

MD5

AES128 or DES-56

32 characters

53 characters

SHA

3DES

80 characters

73 characters

SHA

AES128 or DES-56

40 characters

53 characters

 

acl acl-number: Specifies a basic ACL to filter NMSs by source IPv4 address. The acl-number argument represents a basic ACL number in the range of 2000 to 2999. Only the NMSs with the IPv4 addresses permitted in the ACL can use the specified username to access the SNMP agent.

local: Represents a local SNMP entity user.

engineid engineid-string: Specifies an SNMP engine ID as a hexadecimal string. The engineid-string argument must comprise an even number of hexadecimal characters, in the range of 10 to 64. All-zero and all-F strings are invalid.

Usage guidelines

You must create an SNMPv3 user for the agent and the NMS to use SNMPv3.

You must create an SNMP group before you assign an SNMP user to the group. Otherwise, the user cannot take effect after it is created. An SNMP group can contain multiple users. It defines SNMP objects accessible to the group of users in the MIB view and specifies whether to enable authentication and privacy functions. The authentication and encryption algorithms are defined when a user is created.

When you use the snmp-agent usm-user v3 cipher command, the pri-password argument in this command can be obtained by the snmp-agent calculate-password command. To make the calculated encrypted key applicable to the snmp-agent usm-user v3 cipher command and have the same effect as that in the snmp-agent usm-user v3 cipher command, make sure the same encryption algorithm is specified for the two commands and the local engine ID specified in the snmp-agent usm-user v3 cipher command is consistent with the SNMP entity engine ID specified in the snmp-agent calculate-password command.

When you execute this command repeatedly to configure the same user (the usernames remain the same, no limitation to other keywords and arguments), the last configuration takes effect.

For secrecy, all keys, including keys configured in plain text, are saved in cipher text.

Remember the username and the plaintext password when you create a user. A plaintext password is required when the NMS accesses the SNMP agent.

Examples

# Add the user testUser to the SNMPv3 group testGroup. Configure the security model as authentication without privacy, the authentication algorithm as MD5, the plaintext key as authkey.

<Sysname> system-view

[Sysname] snmp-agent group v3 testGroup authentication

[Sysname] snmp-agent usm-user v3 testUser testGroup authentication-mode md5 authkey

To access the SNMP agent, specifically, the default view (ViewDefault) in this example, the NMS can use the protocol SNMPv3, username testUser, authentication algorithm MD5, and authentication key authkey.

# Add the user testUser to the SNMPv3 group testGroup. Configure the security model as authentication and privacy, the authentication algorithm as MD5, the privacy algorithm as DES56, the plain-text authentication key as authkey, and the plain-text privacy key as prikey.

<Sysname> system-view

[Sysname] snmp-agent group v3 testGroup privacy

[Sysname] snmp-agent usm-user v3 testUser testGroup authentication-mode md5 authkey privacy-mode des56 prikey

To access the SNMP agent, specifically, the default view (ViewDefault) in this example, the NMS must use the protocol SNMPv3, username testUser, authentication algorithm MD5, authentication key authkey, privacy algorithm DES, and privacy key prikey.

Related commands

·           display snmp-agent usm-user

·           snmp-agent calculate-password

·           snmp-agent group

 


display mib-style

Use display mib-style to display the MIB style of the device.

Syntax

display mib-style [ | { begin | exclude | include } regular-expression ]

Views

Any view

Default command level

3: Manage level

Parameters

|: Filters command output by specifying a regular expression. For more information about regular expressions, see Fundamentals Configuration Guide.

begin: Displays the first line that matches the specified regular expression and all lines that follow.

exclude: Displays all lines that do not match the specified regular expression.

include: Displays all lines that match the specified regular expression.

regular-expression: Specifies a regular expression, a case-sensitive string of 1 to 256 characters.

Usage guidelines

Two MIB styles are available on the device: new and compatible. After obtaining the MIB style, you can select matched H3C network management software based on the MIB style.

Examples

# After getting the device ID from node sysObjectID, you find that it is an H3C device, and hope to know the current MIB style or the MIB style after next boot of the device.

<Sysname> display mib-style

 Current MIB style: new

 Next reboot MIB style: new

The above output information shows that the current MIB style of the device is new, and the MIB style after next boot is still new.

Related commands

mib-style

mib-style

Use mib-style to set the MIB style of the device.

Syntax

mib-style [compatible | new ]

Default

The MIB style of the device is new.

Views

System view

Default command level

3: Manage level

Parameters

compatible: Specifies the MIB style of the device as H3C compatible, which means sysOID of the device is located under the H3C enterprise ID 25506, and private MIB is located under the enterprise ID 2011.

new: Specifies the MIB style of the device as H3C new, which means both sysOID and private MIB of the device are located under the H3C enterprise ID 25506.

Usage guidelines

The configuration takes effect only when the device reboots.

Examples

# Change the MIB style of the device to compatible.

<Sysname> system-view

[Sysname] mib-style compatible

[Sysname] quit

<Sysname> display mib-style

 Current MIB style: new

 Next reboot MIB style: compatible

<Sysname> reboot

 

  • Cloud & AI
  • InterConnect
  • Intelligent Computing
  • Intelligent Storage
  • Security
  • SMB Products
  • Intelligent Terminal Products
  • Product Support Services
  • Technical Service Solutions
All Services
  • Resource Center
  • Policy
  • Online Help
  • Technical Blogs
All Support
  • Become A Partner
  • Partner Policy & Program
  • Global Learning
  • Partner Sales Resources
  • Partner Business Management
  • Service Business
All Partners
  • Profile
  • News & Events
  • Online Exhibition Center
  • Contact Us
All About Us
新华三官网