topic Re: Restrict SNMP to OIDs in Firewall and Security Management

Restrict SNMP to OIDs

dj0Nz — Tue, 15 Nov 2022 12:14:42 GMT

Hi,

I searched the documentation but found nothing: Is there a way to restrict SNMP (v3) access for a certain user to a specific set of or single OIDs? F5 (https://support.f5.com/csp/article/K13625) and other vendors have that feature ("Views").

Thanks in advance!

Cheers,
Michael

Re: Restrict SNMP to OIDs

Chris_Atkinson — Wed, 16 Nov 2022 04:30:18 GMT

If it's not mentioned in sk90860: How to configure SNMP on Gaia OS it's likely an RFE that will require further discussion with your local SE, that being said I would suggest referencing sk110113 in your request since it hints at what you're after.

Re: Restrict SNMP to OIDs

dj0Nz — Wed, 16 Nov 2022 07:00:08 GMT

This is exactly what I've been looking for. Doesn't survive upgrades, not officially supported but I don't care. 😁
Will check if that works in R81.10.

Thanks a lot.

Re: Restrict SNMP to OIDs

dj0Nz — Wed, 16 Nov 2022 13:00:24 GMT

Works like a charm:

add snmp usm user remote security-level authNoPriv [...]
echo "rouser remote auth 1.3.6.1.2.1.4.22.1.2" >> /etc/snmp/userDefinedSettings.conf
clish -c "set snmp agent off" && clish -c "set snmp agent on"

Tested with "Get Arp Cache" OID (https://oidref.com/1.3.6.1.2.1.4.22.1.2), user "remote" can only query this specific OID.

Mission complete. 😁