Simple Network Management Protocol (SNMP) Context EngineID Discovery
updates
- rfc-3411 — An Architecture for Describing Simple Network Management Protocol (SNMP) Management Frameworks
also
- std-78
Extracted elements (18)
Format value 6 with enterprise ID 0 was chosen for localEngineID to leverage the existing variable-length format 3 of the SnmpEngineID textual convention while using a reserved, previously unused format value, minimizing changes to the existing SnmpEngineID structure.
RFC 3411 originally requested an IANA registry for SnmpEngineID formats but did not record initial assignments or define allocation rules. RFC 5343 retroactively formalizes those rules, requiring a specification for new format values 1-127 and leaving 128-255 as enterprise-specific.
The discovery mechanism is intentionally independent of SNMP security models so that security models lacking built-in engine ID discovery (such as TSM) can use a common procedure rather than each defining its own mechanism.
contextEngineIDs serve as end-to-end identifiers in SNMP proxy deployments translating between protocol versions or traversing NATs, and they separate SNMP engine identification from transport addresses.
The proposed discovery mechanism is designed to coexist with security-model-specific discovery such as USM's authoritative engine identifier discovery. Security models that lack built-in discovery (e.g., Transport Security Model) can use this mechanism.
An SNMP command responder implementing this specification MUST register their pduTypes using the localEngineID snmpEngineID value by invoking the registerContextEngineID() ASI defined in RFC 3412, in addition to the normal registration under the engine's actual snmpEngineID.
Implementations SHOULD only perform the contextEngineID discovery step when it is needed. If security models such as USM already discover the remote snmpEngineID, no further discovery is necessary.
It is RECOMMENDED to protect the discovery exchange using the security services provided by SNMPv3.
The localEngineID value MUST NOT be used as a value to identify an SNMP engine; specifically, it MUST NOT be used in the snmpEngineID.0 scalar or in the msgAuthoritativeEngineID field in the USM securityParameters.
A context is identified by a contextEngineID (the snmpEngineID of the hosting entity) and a contextName. An individual management information item is identified by a four-tuple: contextEngineID, contextName, object type, and instance identification.
The localEngineID is a well-known snmpEngineID value ('8000000006'H) that always refers to the local default context of an SNMP engine. It uses variable-length format 3 of the SnmpEngineID textual convention with enterprise ID 0 and format value 6.
The scopedPDU is a data structure containing a contextEngineID, a contextName, and a PDU. SNMPv3 message format uses ScopedPDUs to exchange management information.
IANA maintains a registry for SnmpEngineID formats. The fifth octet (format octet) values 0-5 and 128-255 were allocated by RFC 3411; RFC 5343 allocates format value 6 for 'local engine'. New assignments in the 1-127 range require a specification per RFC 5226; values 128-255 are enterprise-specific.
An snmpEngineID may contain sensitive device information such as MAC address, IPv4/IPv6 address, or administratively assigned text. An attacker may use the discovery mechanism to obtain device fingerprinting information that is otherwise not directly accessible.
The default VACM configuration (RFC 3415 Appendix A) and USM discovery (RFC 3414) both expose snmpEngineID at noAuthNoPriv security level. In highly secure environments, the discovery mechanism defined here combined with TSM can avoid cleartext exchange.
The isAccessAllowed() primitive does not take contextEngineID into account, so a request with localEngineID is treated identically to one with the correct snmpEngineID by the access control subsystem. It is therefore not possible to define a special restricted view for contextEngineID discovery.
EngineID discovery follows a four-step procedure: (1) use existing contextEngineID if known; (2) delegate to the security model if it supports discovery (e.g., USM); (3) send a Read Class operation using localEngineID to retrieve snmpEngineID.0; (4) return error if contextEngineID cannot be determined.
The localEngineID is encoded as a 5-octet OCTET STRING value '8000000006'H. The first four octets carry enterprise number 0 (all zeros) and the fifth octet is format value 6 indicating 'local engine'.