Subject: [Isms] EUSM key localization details

From: "Randy Presuhn" <[email-masked]>
Date: Thu, 4 Nov 2004 19:06:53 -0800

Hi -

Page16 of draft-kaushik-snmp-external-usm-00.txt describes
how a RADIUS server will generate a localized key.  It says that the
server will have to have been configured with the set of SNMP Engine
IDs in use by the AAA server.  What isn't clear to me from the text is
how the RADIUS server can know *which* of those SNMP Engine IDs
to use in key localization.

The RADIUS key request from the SNMPv3 agent carries the SNMP
manager's IP address, (as the "Calling-Station-ID") and the user
name (as the "User-Name"), but there's nothing for the agent's SNMP
Engine ID.

Randy

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Balazs Lengyel <[email-masked]>
Date: Fri, 05 Nov 2004 12:00:26 +0100

Hello All,
As a new outsider to this discussion I have some questions:
1) EUSM allows the SNMP agent/manager to cash the localized key for some time. How long ? 
When will it loose it's validity ?

2) If the localized key has to be requested again after every n-th SNMP transaction this 
means that every n-th UDP package will need  additional RADIUS traffic. How many additional 
packets/transactions does this mean ?

3) If the Radius server is unreachable is the SNMPv3 traffic according to EUASM dead ? Or ?

Balazs

-- 
Balazs Lengyel                       Ericsson Hungary Ltd.
AXD Operational Suite (AOS)          OPM & System Manager
ECN: 831 7320                        Fax: +36 1 4377792
Tel: +36-1-437-7320     email: [email-masked]

---

From: Kaushik Narayan <[email-masked]>
Date: Fri, 05 Nov 2004 09:11:32 -0800

Hi Balazs,

Please find my reply inline.

At 03:00 AM 11/5/2004, Balazs Lengyel wrote:
>1) EUSM allows the SNMP agent/manager to cash the localized key for some 
>time. How long ? When will it loose it's validity ?

That has been described in the EUSM proposal. The key-cache-time will
be signalled by the AAA server to the SNMP agents as part of the key
distribution response.

>2) If the localized key has to be requested again after every n-th SNMP 
>transaction this means that every n-th UDP package will need  additional 
>RADIUS traffic. How many additional packets/transactions does this mean ?

The key-cache-time is a configurable parameter on the AAA server and
administrators can configure the time window based on the typical
patterns. It is advisable that this window be in the order of 90-180
seconds since that this is the typical duration of job/operation.

There aren't any fixed SNMP transactions in a session, it depends on
the operation and the key-cache-time.

>3) If the Radius server is unreachable is the SNMPv3 traffic according to 

That has been specified in the proposal as well, agents will use USM in
case the AAA server is down.

regards,
   kaushik!