sun.com | docs.sun.com | How To Buy | My Sun | Worldwide Sites |  |

| Previous Contents Index Next
Chapter 4 # Developing a Remote SNMP Manager NMA information can be accessed using the Simple Network Management Protocol (SNMP). This chapter explains how to configure an external SNMP manager, and provides examples of the configuration files required for three types of SNMP configurations. The Java DMK can be used to develop a remote manager that communicates with the NMA using SNMP. For information on how to use the Java DMK to develop a manager that communicates using SNMP, see "Developing an SNMP Manager" in the Java Dynamic Management Kit 5.0 Tutorial. Alternately, any SNMP manager can be used. This chapter contains the following sections: Configuring an SNMP Agent IP-Based Access Control Lists SNMPv3 User-Based Access Control Configuring SNMPv3 Security SNMP Manager Configuration Examples ## Configuring an SNMP Agent The NMA offers SNMPv1, SNMPv2 and SNMPv3 interfaces via the SNMP protocol adaptor. Edit the following values in the `nma.properties` file to configure the SNMP protocol adaptor:
`com.sun.nhas.ma.adaptors.snmp.enabled` | Set to `true` to enable the SNMP protocol adaptor
`com.sun.nhas.ma.adaptors.snmp.port` | Set to number of the port to be used for SNMP communication, for example, `8085`
`com.sun.nhas.ma.adaptors.snmp.trap.port` | Set to number of the port to be used to send SNMP traps, for example, `8086`
By default the NMA uses the standard Java DMK access control configuration files. The following templates are available for use in a default installation:
``installDir``/etc/opt/SUNWcgha/nma.acl.template | Used for SNMPv1, SNMPv2 and SNMPv3 IP access. For SNMPv3, IP access is only relevant to SNMP traps.
``installDir``/etc/opt/SUNWcgha/nma.uacl.template | Used for SNMPv3 user access only.
Use these templates to create configuration files for customized access control configuration. Edit the `jdmk.acl.file` and `jdmk.uacl.file` properties in the `nma.properties` file to reflect the paths to your access control configuration files. The following three files are included for SNMP traps and security configuration, in accordance with the Internet Engineering Task Force RFC 2573.
``installDir``/etc/opt/SUNWcgha/nma.targets.txt | SNMP trap target configuration file.
``installDir``/etc/opt/SUNWcgha/nma.params.txt | SNMP trap security parameter configuration file.
``installDir``/etc/opt/SUNWcgha/nma.notifs.txt | SNMP trap identification configuration file.
The NMA MIB is located at `/opt/SUNWcgha/etc/ma/nhasmib.txt` in a default installation. Note - SNMPv1 does not support 64-bit counters. Retrieval of CGTP statistics that use 64-bit counters is not possible when using SNMPv1. ## IP-Based Access Control Lists In SNMPv1 and SNMPv2, access control is provided on the basis of the IP address and community of the manager's host machine. Example 4-1 Typical `nma.acl` File
    acl = {
     {
     communities = public
     access = read-only
     managers = yourmanager
     }
     {
     communities = private
     access = read-write
     managers = yourmanager
     }
    }

    trap = {
      {
      trap-community = public
      hosts = yourmanager
      }
    }
### Format of the `acl` Group The `acl` group contains one or more access configurations.
    acl = {
       access1
       access2
         ...
       accessN
    }
Each access configuration has the following format:
    {
       communities = communityList
       access = accessRights
       managers = hostList
    }
The communityList is a list of SNMP community names to which this access control applies. The community names in this list are separated by commas. The accessRights specifies the rights to be granted to all managers connecting from the hosts specified in the hostList. There are two values: either `read-write` or `read-only`. The hostList specifies the hosts of the managers to be granted the access rights. The hostList is a comma-separated list of hosts, each of which can be expressed as any one of the following: A host name An IP address A subnet mask The set of all access configurations defines the access policy of the SNMP agent. A manager whose host is specified in a hostList and that identifies itself in one of the communities of the same configuration will be granted the permissions defined by the corresponding accessRights. A manager's host can appear in several access configurations provided it is associated with a different community list. This will define different access communities with different rights from the same manager. A manager whose host-community identification pair does not appear in any of the access configurations will be denied all access. This means that protocol data units (PDU) from this manager will be dropped without being processed.
Previous Contents Index Next

Copyright 1994-2004 Sun Microsystems