This article explains how to restrict access to specific OIDs in SNMP.
If you have a requirement with SNMP that specific OIDs need to be excluded from SNMP polling for specific community.
This is specifically useful for security reasons where you want to restrict certain SNMP polling agents to only be able to access certain SNMP OIDs on Junos platforms. This can be done with the help of SNMP views. For example, you want a SNMP polling agent 192.168.1.2 to not be able to access the following OID :
We can create a view for this:
root@J2320-2# show snmp view view-1 { oid .1 include; oid 1.3.6.1.2.1.1.1 exclude; } community public { view view-1; authorization read-write; clients { 192.168.1.2/32; } }
This view will restrict the access for 192.168.1.2 in such a way that it will not be able to poll the above given OIDs but will be able to poll everything else.
Mar 26 20:27:10 snmpd[698be231] >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Mar 26 20:27:10 snmpd[698be231] >>> Get-Request Mar 26 20:27:10 snmpd[698be231] >>> Source: 192.168.1.2 Mar 26 20:27:10 snmpd[698be231] >>> Destination: 192.168.1.1 Mar 26 20:27:10 snmpd[698be231] >>> Version: SNMPv1 Mar 26 20:27:10 snmpd[698be231] >>> Request_id: 0x698be231 Mar 26 20:27:10 snmpd[698be231] >>> Community: public Mar 26 20:27:10 snmpd[698be231] >>> Error: status=0 / vb_index=0 Mar 26 20:27:10 snmpd[698be231] >>> OID : sysName.0 Mar 26 20:27:10 snmpd[698be231] >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Mar 26 20:27:10 snmpd[698be231] <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< Mar 26 20:27:10 snmpd[698be231] <<< Get-Response Mar 26 20:27:10 snmpd[698be231] <<< Source: 192.168.1.2 Mar 26 20:27:10 snmpd[698be231] <<< Destination: 192.168.1.1 Mar 26 20:27:10 snmpd[698be231] <<< Version: SNMPv1 Mar 26 20:27:10 snmpd[698be231] <<< Request_id: 0x698be231 Mar 26 20:27:10 snmpd[698be231] <<< Community: public Mar 26 20:27:10 snmpd[698be231] <<< Error: status=0 / vb_index=0 Mar 26 20:27:10 snmpd[698be231] <<< OID : sysName.0 Mar 26 20:27:10 snmpd[698be231] <<< type : OctetString <<< <Note when we poll an OID that is</span> not Mar 26 20:27:10 snmpd[698be231] <<< value: "J2320-2" restricted, we get the response 'type' and 'value' Mar 26 20:27:10 snmpd[698be231] <<< HEX : 4a 32 33 32 30 2d 32 Mar 26 20:27:10 snmpd[698be231] <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
root@J2320-2# run show log snmp-trace Mar 26 20:22:50 J2320-2 clear-log[41247]: logfile cleared Mar 26 20:26:17 snmpd[698be22e] >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Mar 26 20:26:17 snmpd[698be22e] >>> Get-Request Mar 26 20:26:17 snmpd[698be22e] >>> Source: 192.168.1.2 Mar 26 20:26:17 snmpd[698be22e] >>> Destination: 192.168.1.1 Mar 26 20:26:17 snmpd[698be22e] >>> Version: SNMPv1 Mar 26 20:26:17 snmpd[698be22e] >>> Request_id: 0x698be22e Mar 26 20:26:17 snmpd[698be22e] >>> Community: public Mar 26 20:26:17 snmpd[698be22e] >>> Error: status=0 / vb_index=0 Mar 26 20:26:17 snmpd[698be22e] >>> OID : sysDescr.0 Mar 26 20:26:17 snmpd[698be22e] >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Mar 26 20:26:17 snmpd[698be22e] <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< Mar 26 20:26:17 snmpd[698be22e] <<< Get-Response Mar 26 20:26:17 snmpd[698be22e] <<< Source: 192.168.1.2 Mar 26 20:26:17 snmpd[698be22e] <<< Destination: 192.168.1.1 Mar 26 20:26:17 snmpd[698be22e] <<< Version: SNMPv1 Mar 26 20:26:17 snmpd[698be22e] <<< Request_id: 0x698be22e Mar 26 20:26:17 snmpd[698be22e] <<< Community: public Mar 26 20:26:17 snmpd[698be22e] <<< Error: status=2 / vb_index=1 Mar 26 20:26:17 snmpd[698be22e] <<< OID : sysDescr.0 Mar 26 20:26:17 snmpd[698be22e] <<< type : Empty <<<<<<<<< <Note that the response is sent with type 'Empty' </span> Mar 26 20:26:17 snmpd[698be22e] <<< value: and no value Mar 26 20:26:17 snmpd[698be22e] <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<