Managing NerveCenter - Managing SNMP Settings - Configuring an SNMP v3 Agent for NerveCenter -
Discovery and Initialization of SNMP v3 Agents      Configuring an Initial User for Discovering an SNMP v3 Agent

Configuring an SNMP v3 Agent for NerveCenter

Before NerveCenter can discover or poll an SNMP v3 agent on a node, the following information must be configured on the SNMP v3 agent:

• NerveCenter user (also referred to as poll user)
• NerveCenter context (also referred to as poll context)

NerveCenter then polls the SNMP v3 agent on behalf of the poll user in this poll context.

In addition to the poll user and context, the following parameters must be configured on the SNMP v3 agent.

---

   The following descriptions serve only as guidelines for configuring SNMP v3 agents for NerveCenter. For exact procedural details about configuring SNMP v3 agents, consult the user documentation supplied by your SNMP v3 agent provider.

---

• User Name (MD5): (usmUserName) NerveCenter communicates with the SNMP v3 agents using MD5 authentication on behalf of the user name you provide. By default the MD5 authentication user name is NCUser. The user name must be configured on all SNMP v3 agents using MD5 authentication with whom NerveCenter communicates. If you specify a different name for this user on the agent, then you must configure this new user name on all the SNMP v3 agents using MD5 authentication managed by NerveCenter. Moreover you must change the name accordingly in NerveCenter Administrator. The MD5 authentication user name and the SHA-1 authentication user name must be different.
• User Name (SHA-1): (usmUserName) NerveCenter communicates with the SNMP v3 agents using SHA-1 authentication on behalf of the user name you provide. By default the SHA-1 authentication user name is NCUserSHA1. The user name must be configured on all SNMP v3 agents using SHA-1 authentication with whom NerveCenter communicates. If you specify a different name for this user on the agent, then you must configure this new user name on all the SNMP v3 agents using SHA-1 authentication managed by NerveCenter. Moreover you must change the name accordingly in NerveCenter Administrator. The MD5 authentication user name and the SHA-1 authentication user name must be different.
• User Context: (vacmContextName) User context in which NerveCenter communicates with the SNMP v3 agent. NerveCenter uses only one user context for communicating with all SNMP v3 agents, which by default is NCContext. NCContext must be configured on all SNMP v3 agents with whom NerveCenter communicates. If you specify a different context name on the agent, then you must configure this new user context on all the SNMP v3 agents managed by NerveCenter. Moreover you must change the name accordingly in NerveCenter Administrator.

  When determining the context permissions for the NerveCenter user, make sure the user can access all the MIBs that you want NerveCenter to manage. That means the NerveCenter user/context should have access to all the MIB objects that you want NerveCenter to manage, given the security level you choose for the agent.

• Security level: (SecurityLevel) Security level NerveCenter uses to communicate with the SNMP v3 agent. NerveCenter supports all three security levels specified by SNMP v3: authPriv, noAuthNoPriv, and authNoPriv. If you later change the security level for the agent on the node, you must also change this information for the node in NerveCenter Client.

  Make sure to specify the appropriate level of security for the information NerveCenter manages. If you specify noAuthNoPriv, you will not have authentication or encryption for your SNMP v3 messages.

• Authentication Protocol: (usmUserAuthProtocol) At present SNMP v3 specifications define two message authentication schemes: HMAC-MD5-96 (MD5) and HMAC-SHA-96 (SHA). You can choose either of these two protocols for the agent, but you must specify the protocol you choose in NerveCenter Client for the respective node. By default, NerveCenter specifies MD5 for all nodes. If you choose to configure the agent with SHA instead, then you must change this information for the node in NerveCenter Client. The key localization scheme defined in SNMP v3 specifications has a link with the authentication protocol. Therefore, whenever you change the authentication protocol, NerveCenter must recompute the keys for the agent concerned. If you are using noAuthNoPriv security level, then configure the SNMP v3 agent with usmNoAuthProtocol to be used for communication. Of course, then you will not have either authentication or encryption for your SNMP v3 messages.
• Privacy Protocol: (usmUserPrivProtocol) SNMP v3 standard specifies that CBC-DES can be used for encryption services, and that is the only protocol NerveCenter supports. If you want encryption services, then configure the SNMP v3 agent to use CBC-DES as its privacy protocol to communicate on behalf of NerveCenter user in context with the AuthPriv security level. If you are using noAuthNoPriv or AuthNoPriv security levels, then you can configure the SNMP v3 agent with usmNoPrivProtocol. Of course, then you will not have encryption for your SNMP v3 messages. If you use some protocol other than CBC-DES, NerveCenter can not use encryption services to manage the agent.
• Passwords: (AuthKey, PrivKey) Configuring the NerveCenter user also involves configuring the authentication and privacy passwords. The passwords you provide are converted to authentication keys at runtime.

  NerveCenter uses the following as default passwords for the NerveCenter user:

  • NCUserAuthPwd (for the authentication password)
  • NCUserPrivPwd (for the privacy password)

    If you choose a security level of authPriv for a node, both passwords are used. For a security level of authNoPriv, only the authentication password is used. For a security level of noAuthNoPriv, no passwords are used. Depending on the security level you set up for the agent, you must configure the NerveCenter user with these same passwords:

    These passwords, along with snmpEngineID and the authentication protocol (MD5 or SHA) are used to generate keys (AuthKey and PrivKey respectively). Refer to the SNMP v3 specifications for more information. If you choose different authentication and privacy passwords in NerveCenter, then configure all SNMP v3 agents managed by NerveCenter to use the authentication and privacy passwords designated for the NerveCenter user. If you change the passwords on one agent, you must make the change on all SNMP v3 agents managed by NerveCenter.

    Initially you need to configure these passwords directly on all SNMP v3 agents that you want NerveCenter to manage. If you later change the passwords, you can do so from the NerveCenter Administrator.