CSCE 815 Network Security Lecture 17 SNMP Simple Network Management Protocol March 25, 2003

– 2 – CSCE 815 Sp 03 Need for Network Management Tools In the early days of the Arpanet, the predecessor of the Internet, the name service was accomplished by maintaining and distributing one file with all the IP addresses of the network. But no more … DNS etc As networks increase in size  The network becomes more indispensable to the organization.  More things can go wrong, disabling or degrading the performance of portions of the network. Today a large network cannot be managed with software assistance.

– 3 – CSCE 815 Sp 03 SNMP History SNMP version 1 was published in 1988 Widely accepted RFC 1157 SNMP version 2 added additional functionality RFC 1441 (1993) SNMP v3 added security features RFC (1999)

– 4 – CSCE 815 Sp 03 SNMP v3 Introduction and Applicability Statements for Internet Standard Management Framework, RFC 3410, Informational, December 2002 Introduction and Applicability Statements for Internet Standard Management Framework An Architecture for Describing Simple Network Management Protocol (SNMP) Management Frameworks, RFC 3411, STD 62, December 2002 An Architecture for Describing Simple Network Management Protocol (SNMP) Management Frameworks Message Processing and Dispatching for the Simple Network Management Protocol (SNMP) RFC 3412, STD 62, December 2002 Message Processing and Dispatching for the Simple Network Management Protocol (SNMP) Simple Network Management Protocol (SNMP) Applications RFC 3413, STD 62, December 2002 Simple Network Management Protocol (SNMP) Applications User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3) RFC 3414, STD 62, December 2002 User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3) View-based Access Control Model (VACM) for the Simple Network Management Protocol (SNMP) RFC 3415, STD 62, December 2002 View-based Access Control Model (VACM) for the Simple Network Management Protocol (SNMP

– 5 – CSCE 815 Sp 03 SNMP Management Station Management station – typically a stand alone device; an interface for human net manager Management agent – Management information base Network Management protocol Get, Set and Notify

– 6 – CSCE 815 Sp 03 SNMP GOALS UBIQUITY PCs AND CRAYs INCLUSION OF MANAGEMENT SHOULD BE INEXPENSIVE SMALL CODE LIMITED FUNCTIONALITY MANAGEMENT EXTENSIONS SHOULD BE POSSIBLE NEW MIBs MANAGEMENT SHOULD BE ROBUST CONNECTIONLESS TRANSPORT Resource/reference for next few slides Copyright © 2001 by Aiko Pras These sheets may be used for educational purposes

– 7 – CSCE 815 Sp 03 SNMP OPERATION

– 8 – CSCE 815 Sp 03 SNMP

– 9 – CSCE 815 Sp 03 SNMP OPERATION

– 10 – CSCE 815 Sp 03 Basic Concepts of SNMP A network management system is an integrated collection of tools for network monitoring and control. Single operator interface Minimal amount of separate equipment. Software and network communications capability built into the existing equipment.

– 11 – CSCE 815 Sp 03 SNMP Management Station Management station will include: an interface for the human net manager for monitoring and controlling the network an interface for the human net manager for monitoring and controlling the network management applications for data analysis and fault recovery management applications for data analysis and fault recovery Translation of network manager commands to actual controls of the network Translation of network manager commands to actual controls of the network A database of the MIBs of all managed entities of the network A database of the MIBs of all managed entities of the network

– 12 – CSCE 815 Sp 03 SNMP Management Agent Key platforms: hosts, bridges, routers, hubs equipped with SNMP management agent SNMP management agent is a program that communicates with the SNMP management station  Responds to requests for information on network status  Responds to requests for management actions  May asynchronously provide the management station with unsolicited “alert” information

– 13 – CSCE 815 Sp 03 SNMP Management Information Base Each network resource is represented as an object (data variable) Management Information Base (MIB) is the collection of objects that an agent maintains Objects in MIB are standardized across the type of agent such as routers, bridges, etc. A management station monitors the network by requesting values from the MIBs A management station controls the network by setting values in the MIBs of the various agents

– 14 – CSCE 815 Sp 03 SNMP Network Management Protocol Capabilities of SNMP  Get - get the value of an object from an agent  Set – set the value of an object of an agent  Notify – agent alerts the management station

– 15 – CSCE 815 Sp 03 Protocol context of SNMP

– 16 – CSCE 815 Sp 03 Notes on SNMP protocol It was designed to be an application level protocol. It was designed to be easily implemented and consume modest processor and network resources. SNMP  UDP  IP  data link layer (ethernet) Each agent must implement SNMP, UDP and IP. SNMP messages  GetResponse  GetNextResponse  SetRequest  GetResponse  Trap SNMP is connectionless (because UDP is).

– 17 – CSCE 815 Sp 03 SNMP Proxies Note all are capable of implementing SNMP(UDP,IP) e.g., bridges, modems etc. Concept of a proxy was added to accommodate such devices. SNMPv2 added the capability of running on the OSI as well as the TCP/IP protocol suite

– 18 – CSCE 815 Sp 03 Proxy Configuration

– 19 – CSCE 815 Sp 03 SNMPv2 The strength of SNMPv1 was simplicity implying it was easy to implement and configure. However, deficiencies arose:  Lack of support for distributed network management  Functional deficiencies  Security deficiencies The first two were addressed by SNMPv2 and the latter by SNMPv3.

– 20 – CSCE 815 Sp 03

– 21 – CSCE 815 Sp 03 SNMP v1 and v2 Trap – an unsolicited message (reporting an alarm condition) SNMPv1 is ”connectionless” since it utilizes UDP (rather than TCP) as the transport layer protocol. SNMPv2 allows the use of TCP for reliable, connection- oriented” service.

– 22 – CSCE 815 Sp 03 Comparison of SNMPv1 and SNMPv2 Table 8.1 SNMPv1 PDU SNMPv2 PDU DirectionDescription GetRequestGetRequest Manager to agent Request value for each listed object GetRequestGetRequest Manager to agent Request next value for each listed object GetBulkRequest Manager to agent Request multiple values SetRequestSetRequest Manager to agent Set value for each listed object InformRequest Manager to manager Transmit unsolicited information GetResponseResponse Agent to manager or Manage to manager(SNMPv2) Respond to manager request TrapSNMPv2-Trap Agent to manager Transmit unsolicited information

– 23 – CSCE 815 Sp 03 SNMPv1 Community Facility SNMP provides only rudimentary secuirty through the concept of communitiy. SNMP Community – Relationship between an SNMP agent and SNMP managers. Maintain locally on the agent List of managers with associated access privalidges Each agent controls its MIB; aspects of this control Authentication service – which manager can access/control Access policy Proxy service – this may involve implementing authentication service for other devices

– 24 – CSCE 815 Sp 03 SNMP Access Policy SNMP MIB view – a subset of the objects SNMP access modes: Read-Only, Read-Write SNMP community profile = SNMP MIB view + access-mode SNMP access policy = SNMP community + SNMP community-profile

– 25 – CSCE 815 Sp 03 SNMPv1 Administrative Concepts

– 26 – CSCE 815 Sp 03 SNMPv3 SNMPv3 defines a security capability to be used in conjunction with SNMPv2 preferably or possibly v1

– 27 – CSCE 815 Sp 03 SNMPv3 Archttecture Consists of a distributed collection of SNMP entities

– 28 – CSCE 815 Sp 03 SNMP Manager

– 29 – CSCE 815 Sp 03 SNMP Agent

– 30 – CSCE 815 Sp 03 SNMPv3 Flow

– 31 – CSCE 815 Sp 03 PRIMITIVES BETWEEN MODULES

– 32 – CSCE 815 Sp 03 sendPdu

– 33 – CSCE 815 Sp 03 prepareOutgoingMessage

– 34 – CSCE 815 Sp 03 generateRequestMsg

– 35 – CSCE 815 Sp 03 send / receive

– 36 – CSCE 815 Sp 03 prepareDataElements

– 37 – CSCE 815 Sp 03 processIncomingMsg

– 38 – CSCE 815 Sp 03 processPd

– 39 – CSCE 815 Sp 03 isAccessAllowed

– 40 – CSCE 815 Sp 03 returnResponsePdu

– 41 – CSCE 815 Sp 03 prepareResponseMessage

– 42 – CSCE 815 Sp 03 generateResponseMsg

– 43 – CSCE 815 Sp 03 send / receive

– 44 – CSCE 815 Sp 03 prepareDataElements

– 45 – CSCE 815 Sp 03 processIncomingMsg

– 46 – CSCE 815 Sp 03 processResponsePdu

– 47 – CSCE 815 Sp 03 SNMP3 Message Format with USM

– 48 – CSCE 815 Sp 03 User Security Model (USM) Designed to secure against: Modification of information Masquerade Message stream modification Disclosure Not intended to secure against: Denial of Service (DoS attack) Traffic analysis

– 49 – CSCE 815 Sp 03 Key Localization Process

– 50 – CSCE 815 Sp 03 View-Based Access Control Model (VACM) VACM has two characteristics: Determines wheter access to a managed object should be allowed. Make use of an MIB that: Defines the access control policy for this agent. Makes it possible for remote configuration to be used.

– 51 – CSCE 815 Sp 03 Access control decision

– 52 – CSCE 815 Sp 03 Recommended Reading and WEB Sites Subramanian, Mani. Network Management. Addison- Wesley, 2000 Stallings, W. SNMP, SNMPv1, SNMPv3 and RMON 1 and 2. Addison-Wesley, 1999 IETF SNMPv3 working group (Web sites) SNMPv3 Web sites