Discussion

Juniper Networks provides several dozen enterprise MIBs for the JUNOS software.
For a complete list, see http://www.juniper.net/techpubs/software/junos/mibs.html.
From this page, you can download the individual MIBfiles or a complete MIBpackage
that contains the relevant standard MIBs and all the enterprise MIBs. For JUNOS
7.4, this file is called juniper-mibs-7.4R1.tgz (there is a separate file for each JUNOS
release). You can load this complete MIBpackage or the individual MIBfiles onto
your NMS system or MIBbrowser. MIBs often have dependencies because they reference
other MIBs, so when you load them onto the NMS, you need to load them in
the correct sequence. The complete JUNOS MIBpackage places all objects into an
SMI, which is loaded first. All the other information in the MIBfiles reference the
SMI, so the files load correctly.
SNMP Security
SNMPv2 uses a simple security scheme to control the access between managers and
servers. Security is controlled by a community string, which is a password that the
NMS system uses to access the agent’s MIBs. The community string is a very weak
password because it is not encrypted but rather is sent as clear text across the network.
All SNMP requests from the manager to the agent must be configured with the
same community name for the manager to be able to collect information from the
agent. Because the password is not encrypted, the JUNOS SNMP implementation
does not support most SNMP Set operations and read-write MIBobjects, even
those specified as read-write in the MIBRFCs. The exceptions are the ping and the
traceroute MIBs, for which JUNOS supports Set operations. Some additional security
is provided by the fact that you can limit the MIBs and specific objects that the
NMS systems can access on the agent by configuring SNMP views on the router and
granting access to specific views by community (see RFC 3415).
SNMPv3 defines a USM to provide authentication and data encryption. It uses the
HMAC with either MD5 or SHA1 to authenticate users, and CBC-DES to encrypt
the message payload.
4.1 Configuring SNMP
Problem
You want to set the router up to be an SNMP agent so your network SNMPv2 NMS
system can monitor the router.
Solution
Use the following commands to configure the router to be an SNMP agent:
[edit]
aviva@router1# set snmp community public authorization read-only
aviva@router1# show
This is the Title of the Book, eMatter Edition
Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.
Configuring SNMP | 133