Version:

Version:


Table of Contents

New Features

Download PDF
Copy Link

Access control for SNMP based on the MIB-view and VDOM

Administrators can provide access control to SNMP users and communities based on restricting a MIB-view to specific OID subtrees. They can also define access based on the VDOM. This allows multi-tenant FortiGate deployments to provide restricted access per VDOM.

  • MIB-view access control allows the SNMP clients to query specific OIDs that are filtered by the MIB-view settings.

  • VDOM access control allows the SNMP clients to query data from specific VDOMs that are filtered by the VDOM settings.

When access control is enabled, the users can only access the information that is allowed by the access control, and all other information is inaccessible. Administrators have granular control, and can easily restrict specific information based on access control.

To configure MIB-views:
config system snmp mib-view
    edit <MIB view name>
        set include <OIDs>
        set exclude <OIDs>
    next
end

set include <OIDs>>

The OID subtrees to be included in the view. A maximum of 16 subtrees can be added.

set exclude <OIDs>

The OID subtrees to be excluded in the view. A maximum of 64 subtrees can be added.

To configure access control based on MIB-views and VDOMs for SNMP users and communities:
config system snmp user 
    edit <user>
        set mib-view <view>
        set vdoms <vdoms>
    next
end
config system snmp community 
    edit <community>
        set mib-view <view>
        set vdoms <vdoms>
    next
end

set mib-view <view>

The SNMP access control MIB view.

set vdoms <vdoms>

SNMP access control VDOMs.

Example

In this example, two MIB-views are created and, with VDOMs, used to control access for SNMP users and communities.

To configure access control for SNMP users and communities:
  1. Configure two MIB-views:

    config system snmp mib-view
        edit "view1"
            set include "1.3.6.1.2"
        next
        edit "view2"
            set include "1.3.6.1.2.1"
            set exclude "1.3.6.1.2.1.2.1" "1.3.6.1.2.1.4.31" "1.3.6.1.2.1.1.9.1"
        next
    end
  2. Add MIB-view and VDOM restrictions to SNMP users:

    config system snmp user
        edit "v3user"
            set mib-view "view1"
        next
        edit "v3user1"
            set vdom "vdom1"
        next
        edit "v3user2"
            set mib-view "view1"
            set vdoms "root" "vdom1"
        next
    end
  3. Add MIB-view and VDOM restrictions to SNMP communities:

    config system snmp community
        edit 1
            set name "REGR-SYS"
            set vdoms "vdom1"
        next
        edit 2
            set name "REGR-SYS1"
            set mib-view "view2"
        next
        edit 3
           set name "REGR-SYS2"
           set mib-view "view1"
           set vdoms "root" "vdom1"
        next
    end

Access control for SNMP based on the MIB-view and VDOM

Administrators can provide access control to SNMP users and communities based on restricting a MIB-view to specific OID subtrees. They can also define access based on the VDOM. This allows multi-tenant FortiGate deployments to provide restricted access per VDOM.

  • MIB-view access control allows the SNMP clients to query specific OIDs that are filtered by the MIB-view settings.

  • VDOM access control allows the SNMP clients to query data from specific VDOMs that are filtered by the VDOM settings.

When access control is enabled, the users can only access the information that is allowed by the access control, and all other information is inaccessible. Administrators have granular control, and can easily restrict specific information based on access control.

To configure MIB-views:
config system snmp mib-view
    edit <MIB view name>
        set include <OIDs>
        set exclude <OIDs>
    next
end

set include <OIDs>>

The OID subtrees to be included in the view. A maximum of 16 subtrees can be added.

set exclude <OIDs>

The OID subtrees to be excluded in the view. A maximum of 64 subtrees can be added.

To configure access control based on MIB-views and VDOMs for SNMP users and communities:
config system snmp user 
    edit <user>
        set mib-view <view>
        set vdoms <vdoms>
    next
end
config system snmp community 
    edit <community>
        set mib-view <view>
        set vdoms <vdoms>
    next
end

set mib-view <view>

The SNMP access control MIB view.

set vdoms <vdoms>

SNMP access control VDOMs.

Example

In this example, two MIB-views are created and, with VDOMs, used to control access for SNMP users and communities.

To configure access control for SNMP users and communities:
  1. Configure two MIB-views:

    config system snmp mib-view
        edit "view1"
            set include "1.3.6.1.2"
        next
        edit "view2"
            set include "1.3.6.1.2.1"
            set exclude "1.3.6.1.2.1.2.1" "1.3.6.1.2.1.4.31" "1.3.6.1.2.1.1.9.1"
        next
    end
  2. Add MIB-view and VDOM restrictions to SNMP users:

    config system snmp user
        edit "v3user"
            set mib-view "view1"
        next
        edit "v3user1"
            set vdom "vdom1"
        next
        edit "v3user2"
            set mib-view "view1"
            set vdoms "root" "vdom1"
        next
    end
  3. Add MIB-view and VDOM restrictions to SNMP communities:

    config system snmp community
        edit 1
            set name "REGR-SYS"
            set vdoms "vdom1"
        next
        edit 2
            set name "REGR-SYS1"
            set mib-view "view2"
        next
        edit 3
           set name "REGR-SYS2"
           set mib-view "view1"
           set vdoms "root" "vdom1"
        next
    end