SNMPv3 Applications
Extracted elements (30)
A proxy forwarder application has no need of a detailed MIB view definition because it forwards requests based solely on contextEngineID/contextName, irrespective of individual managed object types. In contrast, a command responder must have the MIB view to process objects correctly.
The term 'proxy' is deliberately narrowed in this document to mean only transparent forwarding of SNMP requests and notifications irrespective of the managed object types contained within them, as distinct from MIB aggregation or non-SNMP protocol translation. This avoids the historical confusion caused by the term covering multiple unrelated scenarios.
RFC 2273 was published to correct a clerical error in the snmpModules OID assignments present in RFC 2263; this RFC obsoletes RFC 2263 and provides corrected module identity number assignments.
When forwarding an incoming report indication, if the original incoming management target was SNMPv1, processing of the report indication is halted, since SNMPv1 has no concept of report PDUs.
When forwarding notifications, if for any outgoing management target the incoming SNMP version is SNMPv2 or SNMPv3 and the outgoing version is SNMPv1, that management target is NOT used when generating the forwarded notifications (SNMPv2/v3 Trap/Inform PDUs cannot be down-translated to SNMPv1 traps in this context).
A command responder application MUST always call the returnResponsePdu abstract service interface, even in the event of a resource allocation error. In such cases the PDU passed to returnResponsePdu must contain appropriate errorStatus and errorIndex values.
A proxy forwarder application MUST NOT register a contextEngineID value equal to the snmpEngineID of its associated SNMP engine, to prevent the proxy from intercepting messages intended for local command responders.
Before sending a notification to a management target, a notification originator MUST check access via isAccessAllowed for each variable-binding. If isAccessAllowed does not return accessAllowed, the notification MUST NOT be sent to that management target.
If a notification originator makes management target configuration SNMP-manageable, it MUST use the SNMP-TARGET-MIB module defined in this document.
If a proxy forwarder's translation table is SNMP-manageable, it MUST use the SNMP-PROXY-MIB module defined in this document.
When a command generator receives a response, it MUST discard the response if any of messageProcessingModel, securityModel, securityName, contextEngineID, contextName, pduVersion, or request-id differ from the values used in the original request.
When a proxy forwarder cannot find appropriate outgoing management target information, it MUST increment the snmpProxyDrops counter and call returnResponsePdu with a statusInformation indicating the error and the OID/value of snmpProxyDrops before halting processing.
When forwarding requests between SNMP versions and the outgoing version is SNMPv1 while the incoming is SNMPv2 or SNMPv3 (or vice versa), the proxy forwarder MUST apply the translation rules documented in RFC 1908.
A Management Target is defined as two-part information: (1) destination transport domain and transport address (transport endpoint), and (2) SNMP parameters consisting of message processing model, security model, security level, and security name. A many-to-many relationship may exist between transport endpoints and SNMP parameter sets.
Five SNMP application types are defined: Command Generators (initiate Get/GetNext/GetBulk/Set), Command Responders (process incoming requests), Notification Originators (generate Trap/Inform), Notification Receivers (receive notifications), and Proxy Forwarders (forward requests or notifications). Multiple application types may coexist on a single SNMP engine.
snmpTargetSpinLock (TestAndIncr) provides a concurrency control mechanism for multi-manager modifications to the snmpTargetAddrTable, particularly snmpTargetAddrTagList. The procedure is: read spinLock and tagList, generate new tagList, then set both in one request; retry from step 1 if the spinLock set fails.
snmpUnavailableContexts and snmpUnknownContexts (Counter32, read-only, snmpTargetObjects 4 and 5) count packets dropped because the requested context was unavailable or unknown, respectively. These counters are mandatory for command responder compliance.
The isAccessAllowed abstract service interface is called by command responders and notification originators to check MIB view access. Parameters include securityModel, securityName, securityLevel, viewType (read/write/notify), contextName, and variableName (OID). Errors noSuchView/noAccessEntry/noGroupName yield authorizationError; noSuchContext increments snmpUnknownContexts.
The processResponsePdu abstract service interface delivers responses to command generators. It carries messageProcessingModel, securityModel, securityName, securityLevel, contextEngineID, contextName, pduVersion, PDU, statusInformation, and the sendPduHandle originally returned by sendPdu.
The registerContextEngineID abstract service interface allows a command responder or proxy forwarder to register with the Dispatcher for a given contextEngineID and pduType. Duplicate registrations for the same contextEngineID/pduType are denied; only one registrant per combination is allowed.
The sendPdu abstract service interface is used by command generators and notification originators to dispatch PDUs. Key parameters include transportDomain, transportAddress, messageProcessingModel, securityModel, securityName, securityLevel, contextEngineID, contextName, pduVersion, PDU, and expectResponse. On success it returns a sendPduHandle for correlating responses.
The SNMP-NOTIFICATION-MIB contains three tables: snmpNotifyTable (selects target addresses and notification type Trap vs Inform), a sparse augmentation of snmpTargetAddrTable associating filter profiles with targets, and snmpNotifyFilterTable defining OID subtree-based filters that limit which notifications are sent to which targets.
The snmpTargetAddrTable (OID snmpTargetObjects 2) stores transport endpoint information for management targets. Each entry (indexed by snmpTargetAddrName) contains snmpTargetAddrTDomain, snmpTargetAddrTAddress, snmpTargetAddrTimeout (default 1500), snmpTargetAddrRetryCount (default 3), snmpTargetAddrTagList, snmpTargetAddrParams, snmpTargetAddrStorageType, and snmpTargetAddrRowStatus.
The snmpTargetParamsTable (OID snmpTargetObjects 3) stores SNMP message generation parameters. Each entry (indexed by snmpTargetParamsName) contains snmpTargetParamsMPModel, snmpTargetParamsSecurityModel (range excludes 255), snmpTargetParamsSecurityName, snmpTargetParamsSecurityLevel, snmpTargetParamsStorageType, and snmpTargetParamsRowStatus. Active rows cannot have their security parameters modified.
SNMP-NOTIFICATION-MIB is defined in this document under snmpModules, providing MIB objects for remote configuration of notification generation parameters including target selection and notification filtering.
SNMP-PROXY-MIB is defined in this document under snmpModules (section 4.3), providing a snmpProxyTable for configuring management target translation in proxy forwarder applications.
SNMP-TARGET-MIB is assigned MODULE-IDENTITY OID { snmpModules 12 }. This document corrects a clerical error in the snmpModules assignment from RFC 2263, which this RFC obsoletes.
The MIB modules defined in this document (SNMP-TARGET-MIB, SNMP-NOTIFICATION-MIB, SNMP-PROXY-MIB) provide write access to SNMP engine configuration including transport addresses, security parameters, and proxy forwarding rules. Unauthorized write access could allow an attacker to redirect notifications, alter forwarding paths, or weaken security levels. Implementations should ensure appropriate access controls are applied to these objects.
For Inform PDU notifications, the notification originator enters a retry loop: send Inform → wait for response within timeout → if response received, mark acknowledged and delete cached info; if timeout or report received, retry using cached management target info. States are: Pending, Acknowledged (success), and Failed (retry count exceeded).
SnmpTagValue and SnmpTagList are UTF-8 encoded OCTET STRING types (SIZE 0..255). A tag value may not contain delimiter characters (ASCII space 0x20, TAB 0x09, CR 0x0D, LF 0x0B) and may not be zero-length. A tag list separates tag values with single delimiter characters; no leading, trailing, or adjacent delimiters are allowed.