User's Guide Part 1

Chapter 1: Product description System management
The secure configuration should be configured in a controlled environment to prevent
disclosure of the initial security keys necessarily sent as plaintext, or sent as encrypted data
using a predictable key. The initial security information should not be configured over an
insecure network.
The default configuration is restored when any of the following occurs:
• All ODU configuration data is erased.
• All SNMP users are deleted using the SNMP management interface.
• The SNMP Engine ID Format has been changed.
• The SNMP Engine ID Format is Internet Address AND the Internet Address has been
changed.
• The SNMP Engine ID Format is Text String AND the text string has been changed.
• The SNMP Engine ID Format is MAC Address AND configuration has been restored using a
file saved from a different unit.
• SNMPv3 Security Management is changed from web-based to MIB-based.
The default user configuration is specified in SNMPv3 default configuration (MIB-based) on
page 3-55.
PTP 700 creates the initial user and template users with localized authentication and privacy
keys derived from the passphrase string 123456789. Authentication keys for the templates
users are fixed and cannot be changed. Any or all of the template users can be deleted.
The default user
initial is created with a view of the entire MIB, requiring authentication for
SET operations. There is no access for template users.
Note
VACM grants access for requests sent with more than the configured security level.
The default user
initial will have read/write access to the whole of the MIB. This is described
in further detail in View-based access control model on page 1-45. The template users have no
access to the MIB in the default configuration. User
initial will normally be used to create one
or more additional users with secret authentication and privacy keys, and with appropriate
access to the whole of the MIB or to particular views of the MIB according to the operator’s
security policy. New users must be created by cloning template users. The user
initial may
then be deleted to prevent access using the well-known user name and keys. Alternatively, the
keys associated with
initial may be set to some new secret value.
Web-based management of SNMPv3 security
PTP 700 supports an alternative, web-based approach for configuring SNMPv3 security. In this
case, the web-based interface allows users to specify SNMPv3 users, security levels, privacy
and authentication protocols, and passphrases. Web-based management will be effective for
many network applications, but the capabilities supported are somewhat less flexible than
those supported using the MIB-based security management.
Selection of web-based management for SNMPv3 security disables the MIB-based security
management.
Web-based management of SNMPv3 security allows for two security roles:
Page 1-46