1. Network Management Protocols and Security
– Chapter 8

2. Chapter 8 Objectives
Define and describe a Management Information Base (MIB)
Define and describe Simple Network Management Protocol (SNMP)
Define SNMP message types
Define and describe Remote Network Monitoring (RMON)
CMIP/CMIS

3. The Funnel Approach to Creating a Standard
Interfaces
OSI Model
Approximately
1–2 Years
Approximately
6 Months
Creates a Draft
for a Standard

4. SNMP Overview
SNMP v1 was developed in 1988
Simple
Stopgap measure

5. SNMP Components The basic components of SNMP are: Manager Agent
Management Information Base (MIB)
Network Management Protocol

6. SNMP Architecture Management Managed Station Device Queries/Response
Functions (FCAPS)
Processes
Queries/Response
Agent Function
Processes
Application Access
Control and
User Interface
Traps/Alarms
MIB

7. SNMP Architecture (cont.)
Network Service
Manager Process
MIB
SNMP
UDP IP IP
Network Interface
(e.g., Ethernet, FDDI, x.25)
Network Interface
(e.g., Ethernet, FDDI, x.25)
Management
Station
Network
Device
Query
Manager
Responses
Agent
Traps/Alarms
MIB
e.g., x.25
Communications Network

8. MIB Structure Categorization Collection of related objects
How groupings relate
Agents

9. MIB Tree iso (1) org (3) dod (6) internet (1) directory (1) mgmt. (2)
system (1)
interfaces (2)
nt (3)
ip (4)
icmp (5)
tcp (6)
udp (7)
egp (8)
transmission (10)
snap (11)
experimental (3)
private (4)
enterprises (1)

10. SNMP v1 Message Types SNMP Manager Agent GetRequest GetResponse
GetNextRequest
Trap
SetRequest
The three foundation specifications are:
RFC 1155 – “Structure and Identification of Management Information for TCP/IP-Based Networks”
RFC 1213 – “Management Information Base for Network Management of TCP/IP-Based Internets: MIB II”
RFC 1157 – “Simple Network Management Protocol”

11. SNMP Messages Implemented on top of UDP/IP/Ethernet

12. Proxy Configuration
To accommodate devices that do not implement SNMP
The proxy agent converts each SNMP query into the management protocol supported by the managed device

13. SNMPv2 Drawbacks of SNMPv1:
Lack of support for distributed network management
Functional deficiencies
Security deficiencies
SNMPv2 (1993) is intended to run on the OSI Protocol suite:
Supports a greater networked configurations
Overcomes the functional deficiencies of SNMPv1
Supports distributed network management
RFCs (1996): 1901, , 2578, and 2579

14. InformRequestResponse
SNMP v2 Commands
GetRequest
GetResponse
Agent
GetNextRequest
Trap
Manager
SetRequest
GetBulkRequest
GetBulkResponse
InformRequest
Manager
InformRequestResponse

15. Distributed Management Configuration
The Inform command can be used to construct a multiple management cooperation in a large network

16. SNMPv1 Security Aspects
Supports Security through the SNMP Community concept:
A relationship between an SNMP agent and a set of SNMP managers
Defines authentication, access control, and proxy characteristics
Authentication Service
The community name associated with each message serves as a password.
Access Control
The agent can provide different categories of MIB access to different managers
Combination of an MIB view and access mode provides an SNMP Community Profile
Proxy Service
The proxy knows which MIB object can be used and their access mode
SNMPv1 Security Administrative Concepts

17. SNMP v3 A working group within IETF produced SNMPv3 in 1998:
Defines a framework for security features
Supports an architecture to cover different versions of SNMP
RFCs describe architecture, messages, and security features
Security-related processing occurs at the message level through a User Security Model (USM) field

18. SNMP v3 Architecture Manager Agent MIB Instrumentation SNMP
Applications
Message
Processing
SNMP Engine
Manager
Dispatch
Agent
Security
Access
Control
MIB Instrumentation
SNMP Applications
IP Network
Transport
SNMP Transport – Gets and formats messages; sends the messages into the transport data units.
Message Dispatch – Creates protocol data units (PDU) in the application header.
Message Processing – Processes and dispatches messages to appropriate SNMP version.
Security – Performs authentication and encryption for SNMP messages.
Authorization – Provides authentication services to provide access to the MIB.
SNMP Application – Provides procedures for each application when generating PDU.
MIB Instrumentation – Provides access procedure to access the MIB.

19. SNMP v3 User Security Model
USM provides authentication and privacy services
Authentication protocol HMAC-MD5-96 and HMAC-SHA-96
DES in cipher block chaining (CBC) mode
SNMP engine uses two values: a 16-octet privKey for DES and a 16-octet authKey for HMAC algorithm, for both local users and remote users
Encryption is performed first, then authentication is performed, if needed.
RFC 2574 provides guidelines for the creation, update, and management of these keys.
SNMP v3 Message format with USM

20. Benefits of SNMP Availability of agents Implementation Agent-level
Polling
Robust and extensible
Manager-agent interface

21. Drawbacks of SNMP Security Object-orientation Difficult to integrate
High communications
Private MIBs
No standard control definition

22. RMON (Remote Network Monitoring)
Provides standard information
Hardware and software
Probes
Latest version

23. RMON Configuration NMS Station with RMON MIB Router Router RMON FDDI
Agent
FDDI

24. CMIP/CMIS Managing System Managed System Queries/Response Manager
Agent
Traps/Alarms
OSI
Stack
OSI
Stack
CMIS
Interface
CMIP Protocol
CMIS
Interface