Subject: Comments on new CD MIB (in relation to RFC-2576, Target and notif ication MIBs)

From: "Siripunkaw, Pak" <[email-masked]>
Date: Tue, 18 Apr 2000 10:41:13 -0400

Comments on new CD MIB (in relation to RFC-2576, Target and notification
MIBs)
(By Pak Siripunkaw and Bill Yost)

Motivation of the comments:
It is getting too complicated to determine what controls access to the modem
(docsDevNmAccessTable or SNMP V3 Tables) and where traps are sent
(docsDevNmAccessTable or SNMP V3 Tables).  This should be determined by
which mode (SNMP V1/V2c mode versus SNMP V3 Mode) the modem is in instead of
whether or not docsDevNmAccessTable is empty or not.

1.) If the configuration file does not contain TLV34.1 and 34.2, then the CM
operates in v1/v2c mode:
During the CM registration:
*	Before the setting of docsDevNmAccessTable, CM MUST only allow RO
access from any SNMPv1/v2c manager. CM does not allow any access from SNMPv3
manager.
*	docsDevNmAccessTable  entries are set to control SNMP Access and
trap target 
*	Any entries made to the Community MIB, Target and Notification MIB
will be ignored
After the CM registration:
*	docsDevNmAccessTable control SNMP Access and trap target
*	Community MIB, Target and notification MIB, and other SNMPv3 related
MIB are not accessible by any SNMP manager

2.) If the configuration file does contain TLV34.1 and 34.2, then the CM
operates in v3 mode with v1/v2c coexistence:
During the CM registration and while SNMP V3 initial user keys are being
calculated:
*	Before the setting of the Community MIB, CM MUST only allow RO
access from any SNMPv1/v2 manager. CM does not allow any access from SNMPv3
manager
*	Community MIB, Target and notification MIB, and other SNMPv3 related
MIB are not accessible by any SNMP manager
*	Community MIB entries are set to control SNMP Access.  Target and
notification MIB entries are set to control SNMP trap target.
*	Any entries made to the docsDevNmAccessTable  will be ignored.

After the Registration is complete and SNMPv3 initialization has completed:
*	Community MIB control the translation of SNMPv1/v2c packets'
community strings into security name which select entries in the VACM mib
*	USM table controls SNMPv3 packets
*	docsDevNmAccessTable is not accessible by any NMS stations

3.) Two new config file elements to ease filling in SNMP V3 tables during
registration:

a. Defining a Trap Receiver in the Configuration file
A config file element named V3TrapReceiver can be defined to define a trap
receiver in V3 mode.  This element specifies a Network Management Station
that will receive traps from the modem when it is in V3 mode. Up to 10 of
these elements may be included in the configuration file.  Here is the
format of this element:

       Definition of fields of V3TrapReceiver Element
       All multi-byte fields have the most significant
       bytes first in the field.
Field           Bytes   Description
IP Address        4     IP Address of the trap receiver
Port              2     UDP Port number of the trap receiver
                        (Normally you would use the standard value 162)
Trap type         2     Determines the type of trap sent by the modem (1)
                        1 = SNMP V1 trap in an SNMP V1 packet
                        2 = SNMP V2 trap in an SNMP V2 packet
                        3 = SNMP inform in an SNMP V2 packet
                        4 = SNMP V2 trap in an SNMP V3 packet
                        5 = SNMP inform in an SNMP V3 packet
Timeout           2     Timeout, in milliseconds used for sending inform
Retries           2     Number of retries beyond the first transmission of
                        informs.
Filter length     2     n = Number of 4 byte components in the Filter OID
(value = n)             0 means the Filter OID is the root of the entire
                        MIB tree supported by the modem.  All traps will
                        be sent to the trap receiver.
Filter OID       4*n    Each 4 bytes is a component of the Object Identifier
                        of the root of the Trap Filter Sub-Tree (2)

(1) Trap Type: The community String for traps in SNMP V1 and V2 packets will
be "public".  The Security Name in traps and informs in SNMP V3 packets will
be "@config".  All V3 packet traps will be of Security Level noAuthNoPriv.
(2) Filter OID:  SNMP V3 allows the specification of which Trap OID's are to
be sent to a trap receiver.  The filter OID in the config element specifies
the OID of the root of a trap filter sub-tree.  All Traps with a Trap OID
contained in this trap filter sub-tree will be sent to the trap receiver.

b. Config file Element to replicate the docsDevNmAccessTable into the SNMP
V3 tables
This config file element has no parameters included with it.  It merely
directs the modem to examine the contents of the docsDevNmAccessTable after
registration is complete and make appropriate entries in the
snmpCommunityTable, snmpTargetAddrTable, snmpTargetAddrExtTable,
snmpTargetParamsTable, snmpNotifyTable, usmUserTable,
vacmSecurityToGroupTable, vacmAccessTable.  The entries that are made will
provide the equivalent SNMP v1/v2C access control and SNMP v1 trap receivers
as specified in the docsDevNmAccessTable.  This element only takes effect if
the modem is put into SNMP V3 mode.  After taking effect, the
docsDevNmAccessTable will not be accessible and will have no control over
the modem from that point forward.  This allows operators to set up these
SNMP V3 table entries in a much more convenient and familiar way.  The exact
entries made in these tables are not specified here, but must be made so
that when these tables are used as specified in the SNMP V3 RFC's, the
effect is the same as if docsDevNmAccessTable had been used instead.  The
docsDevNmAccessInterfaces column will be treated as if set to allow access
from all interfaces since the SNMP V3 tables do not allow limiting access on
a per interface basis.

4.) General comments for NmAccessTable: 
docsDevNmAccessIP/docsDevNmAccessIpMask. If we are going to continue to
support NmAccessTable, then the description of this object on how to setup
to allow any NMS needs to be changed.

	The correct rule for this access control is the following :

	If ((NmAccessIP AND NmAccessIpMask)) == ((SrcIpAddr AND
NmAccessIpMask))

			Permit the access from SrcIpAddr
	Else
			Do NOT permit the access from SrcIpAddr

	So to allow any NMS the Ipmast MUST be 0.0.0.0 and IP can be 0.0.0.0
or any IP 
	There has to be a clear statement to make sure that Trap can only be
sent to a specific device.

5.) Need to add DocsDevNmAccessTrapVersion to control the trap version when
the CM is in v1/v2c and NmAccess is being used.  This object is being
proposed by the OSSI 1.1 document.

6.) If NmaccessTable is being used, docsDevNmAccessInterfaces object does
not have the same capability as the IpfilterInterfaces and
LLCfilterInterfaces. Why don't make it the same?

7.) Trap throttling and limiting control MUST be done from the objects in
CD-MIB. This is a cleaner way to do this.