Concept Guide

SHA authentication needs to be used with the AES-CFB128 privacy algorithm only when FIPS is enabled because SHA is then
the only available authentication level. If FIPS is disabled, you can use MD5 authentication in addition to SHA authentication with
the AES-CFB128 privacy algorithm
You cannot modify the FIPS mode if SNMPv3 users are already configured and present in the system. An error message is
displayed if you attempt to change the FIPS mode by using the fips mode enable command in Global Configuration mode.
You can enable or disable FIPS mode only if SNMPv3 users are not previously set up. If previously configured users exist on the
system, you must delete the existing users before you change the FIPS mode.
Keep the following points in mind when you configure the AES128-CFB algorithm for SNMPv3:
1. SNMPv3 authentication provides only the sha option when the FIPS mode is enabled.
2. SNMPv3 privacy provides only the aes128 privacy option when the FIPS mode is enabled.
3. If you attempt to enable or disable FIPS mode and if any SNMPv3 users are previously configured, an error message is
displayed stating you must delete all of the SNMP users before changing the FIPS mode.
4. A message is logged indicating whether FIPS mode is enabled for SNMPv3. This message is generated only when the first
SNMPv3 user is configured because you can modify the FIPS mode only when users are not previously configured. This log
message is provided to assist your system security auditing procedures.
Configuration Task List for SNMP
Configuring SNMP version 1 or version 2 requires a single step.
NOTE:
The configurations in this chapter use a UNIX environment with net-snmp version 5.4. This environment is only one
of many RFC-compliant SNMP utilities you can use to manage your Dell EMC Networking system using SNMP. Also, these
configurations use SNMP version 2c.
● Creating a Community
Configuring SNMP version 3 requires configuring SNMP users in one of three methods. Refer to Setting Up User-Based
Security (SNMPv3).
Related Configuration Tasks
● Managing Overload on Startup
● Reading Managed Object Values
● Writing Managed Object Values
● Subscribing to Managed Object Value Updates using SNMP
● Copying Configuration Files via SNMP
● Manage VLANs Using SNMP
● Enabling and Disabling a Port using SNMP
● Fetch Dynamic MAC Entries using SNMP
● Deriving Interface Indices
● Monitor Port-channels
Important Points to Remember
● Typically, 5-second timeout and 3-second retry values on an SNMP server are sufficient for both LAN and WAN applications.
If you experience a timeout with these values, increase the timeout value to greater than 3 seconds, and increase the retry
value to greater than 2 seconds on your SNMP server.
● User ACLs override group ACLs.
804
Simple Network Management Protocol (SNMP)