BROCADE IP PRIMER

Chapter 6: The Brocade CLInity string, the switch will receive the new change and apply it (e.g., adding astatic route, changing the switch's name, configuring an interface's speed,etc.).SNMP is frowned on by some administrators. There are more than a few securityconcerns about what I've just described. The only thing keeping anattacker from seeing information you don't want them to see (or worse, changinginformation that you don't want them to change) is knowing the communitystring. And here's more bad news. In SNMP version 1, the community string issent in clear text. Anyone generating a packet capture of SNMP traffic can veryeasily see both your read-only and read-write community strings.There is a happy ending to this story. In RFC's 3411-3418, the IETF has definedSNMP version 3. This version provides authentication, privacy, and accesscontrol. SNMP version 3 is supported on all Brocade switches. But for thescope of this book, we're just going to focus on SNMP version 1.Let's see how we configure the community strings:Switch#conf tSwitch(config)#snmp-server community public roSwitch(config)#snmp-server community private rwThe words “public” and “private” are arbitrary choices for the community stringname. We could have just as easily have chosen:Switch#conf tSwitch(config)#snmp-server community frank roSwitch(config)#snmp-server community alice rwThe strings themselves can be anything, and it may be a good idea to makethem fairly cryptic (especially, the read-write). In the above example, the readonlycommunity string is “frank.” The read-write community string is “alice.”When you look at your running config after configuring the strings, you'll noticethat they are replaced by five periods, just like your passwords:Switch#show run | include snmpsnmp-server community ..... rosnmp-server community ..... rwSwitch#Like the passwords, if you were to copy the config to a TFTP server, you wouldsee an encrypted hash where the community string is supposed to be. Youhave the option not to encrypt the community string if you prefer. You indicatethis when you create the string, using a “0” (zero) to specify no encryption, or a“1” (one) to specify encryption:Switch(config)#snmp-server community 0 frank roSwitch(config)#snmp-server community 1 alice rwIn this example, “frank” will not be encrypted, but “alice” will be. Again, thecommunity strings are encrypted by default, so the “1” is assumed, if it is notspecified.148 Brocade IP Primer