Description

This article explains how to restrict access to specific OIDs in SNMP.


Symptoms

If you have a requirement with SNMP that specific OIDs need to be excluded from SNMP polling for specific community.

This is specifically useful for security reasons where you want to restrict certain SNMP polling agents to only be able to access certain SNMP OIDs on Junos platforms.
This can be done with the help of SNMP views.

For example, you want a SNMP polling agent 192.168.1.2 to not be able to access the following OID :

sysDescr 1.3.6.1.2.1.1.1
sysServices 1.3.6.1.2.1.1.7

Solution


We can create a view for this:

root@J2320-2# show snmp
view view-1 {
    oid .1 include;
    oid 1.3.6.1.2.1.1.1 exclude;
}
community public {
    view view-1;
    authorization read-write;
    clients {
        192.168.1.2/32;
    }
}

This view will restrict the access for 192.168.1.2 in such a way that it will not be able to poll the above given OIDs but will be able to poll everything else.

NOTE: Please be sure to add ‘oid .1 include’ , otherwise you will not be able to poll anything.

SNMP Traceoptions Logs :

1) When you poll a non-restricted OID sysName (1.3.6.1.2.1.1.5)

Mar 26 20:27:10 snmpd[698be231] >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Mar 26 20:27:10 snmpd[698be231] >>> Get-Request
Mar 26 20:27:10 snmpd[698be231] >>> Source: 192.168.1.2
Mar 26 20:27:10 snmpd[698be231] >>> Destination: 192.168.1.1
Mar 26 20:27:10 snmpd[698be231] >>> Version: SNMPv1
Mar 26 20:27:10 snmpd[698be231] >>> Request_id: 0x698be231
Mar 26 20:27:10 snmpd[698be231] >>> Community: public
Mar 26 20:27:10 snmpd[698be231] >>> Error: status=0 / vb_index=0
Mar 26 20:27:10 snmpd[698be231] >>> OID : sysName.0
Mar 26 20:27:10 snmpd[698be231] >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Mar 26 20:27:10 snmpd[698be231] <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
Mar 26 20:27:10 snmpd[698be231] <<< Get-Response
Mar 26 20:27:10 snmpd[698be231] <<< Source: 192.168.1.2
Mar 26 20:27:10 snmpd[698be231] <<< Destination: 192.168.1.1
Mar 26 20:27:10 snmpd[698be231] <<< Version: SNMPv1
Mar 26 20:27:10 snmpd[698be231] <<< Request_id: 0x698be231
Mar 26 20:27:10 snmpd[698be231] <<< Community: public
Mar 26 20:27:10 snmpd[698be231] <<< Error: status=0 / vb_index=0
Mar 26 20:27:10 snmpd[698be231] <<< OID : sysName.0
Mar 26 20:27:10 snmpd[698be231] <<< type : OctetString             <<< <Note when we poll an OID that is</span> not
Mar 26 20:27:10 snmpd[698be231] <<< value: "J2320-2"                         restricted, we get the response 'type' and 'value'
Mar 26 20:27:10 snmpd[698be231] <<< HEX : 4a 32 33 32 30 2d 32
Mar 26 20:27:10 snmpd[698be231] <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

2) When we poll a restricted OID sysDescr (1.3.6.1.2.1.1.1)

root@J2320-2# run show log snmp-trace
Mar 26 20:22:50 J2320-2 clear-log[41247]: logfile cleared
Mar 26 20:26:17 snmpd[698be22e] >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Mar 26 20:26:17 snmpd[698be22e] >>> Get-Request
Mar 26 20:26:17 snmpd[698be22e] >>> Source: 192.168.1.2
Mar 26 20:26:17 snmpd[698be22e] >>> Destination: 192.168.1.1
Mar 26 20:26:17 snmpd[698be22e] >>> Version: SNMPv1
Mar 26 20:26:17 snmpd[698be22e] >>> Request_id: 0x698be22e
Mar 26 20:26:17 snmpd[698be22e] >>> Community: public
Mar 26 20:26:17 snmpd[698be22e] >>> Error: status=0 / vb_index=0
Mar 26 20:26:17 snmpd[698be22e] >>> OID : sysDescr.0
Mar 26 20:26:17 snmpd[698be22e] >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Mar 26 20:26:17 snmpd[698be22e] <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
Mar 26 20:26:17 snmpd[698be22e] <<< Get-Response
Mar 26 20:26:17 snmpd[698be22e] <<< Source: 192.168.1.2
Mar 26 20:26:17 snmpd[698be22e] <<< Destination: 192.168.1.1
Mar 26 20:26:17 snmpd[698be22e] <<< Version: SNMPv1
Mar 26 20:26:17 snmpd[698be22e] <<< Request_id: 0x698be22e
Mar 26 20:26:17 snmpd[698be22e] <<< Community: public
Mar 26 20:26:17 snmpd[698be22e] <<< Error: status=2 / vb_index=1
Mar 26 20:26:17 snmpd[698be22e] <<< OID : sysDescr.0
Mar 26 20:26:17 snmpd[698be22e] <<< type : Empty                <<<<<<<<< <Note that the response is sent with type 'Empty' </span>
Mar 26 20:26:17 snmpd[698be22e] <<< value:                                                  and no value
Mar 26 20:26:17 snmpd[698be22e] <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<