Access control for SNMP based on the MIB-view and VDOM
Administrators can provide access control to SNMP users and communities based on restricting a MIB-view to specific OID subtrees. They can also define access based on the VDOM. This allows multi-tenant FortiGate deployments to provide restricted access per VDOM.
-
MIB-view access control allows the SNMP clients to query specific OIDs that are filtered by the MIB-view settings.
-
VDOM access control allows the SNMP clients to query data from specific VDOMs that are filtered by the VDOM settings.
When access control is enabled, the users can only access the information that is allowed by the access control, and all other information is inaccessible. Administrators have granular control, and can easily restrict specific information based on access control.
To configure MIB-views:
config system snmp mib-view edit <MIB view name> set include <OIDs> set exclude <OIDs> next end
set include <OIDs>> |
The OID subtrees to be included in the view. A maximum of 16 subtrees can be added. |
set exclude <OIDs> |
The OID subtrees to be excluded in the view. A maximum of 64 subtrees can be added. |
To configure access control based on MIB-views and VDOMs for SNMP users and communities:
config system snmp user edit <user> set mib-view <view> set vdoms <vdoms> next end
config system snmp community edit <community> set mib-view <view> set vdoms <vdoms> next end
set mib-view <view> |
The SNMP access control MIB view. |
set vdoms <vdoms> |
SNMP access control VDOMs. |
Example
In this example, two MIB-views are created and, with VDOMs, used to control access for SNMP users and communities.
To configure access control for SNMP users and communities:
-
Configure two MIB-views:
config system snmp mib-view edit "view1" set include "1.3.6.1.2" next edit "view2" set include "1.3.6.1.2.1" set exclude "1.3.6.1.2.1.2.1" "1.3.6.1.2.1.4.31" "1.3.6.1.2.1.1.9.1" next end
-
Add MIB-view and VDOM restrictions to SNMP users:
config system snmp user edit "v3user" set mib-view "view1" next edit "v3user1" set vdom "vdom1" next edit "v3user2" set mib-view "view1" set vdoms "root" "vdom1" next end
-
Add MIB-view and VDOM restrictions to SNMP communities:
config system snmp community edit 1 set name "REGR-SYS" set vdoms "vdom1" next edit 2 set name "REGR-SYS1" set mib-view "view2" next edit 3 set name "REGR-SYS2" set mib-view "view1" set vdoms "root" "vdom1" next end