Access control for SNMP

Administrators can provide access control to SNMP users and communities based on restricting a MIB view to specific OID subtrees. They can also define access based on the VDOM. This allows multi-tenant FortiGate deployments to provide restricted access per VDOM.

• MIB view access control allows the SNMP clients to query specific OIDs that are filtered by the MIB view settings.

• VDOM access control allows the SNMP clients to query data from specific VDOMs that are filtered by the VDOM settings.

When access control is enabled, the users can only access the information that is allowed by the access control, and all other information is inaccessible. Administrators have granular control, and can easily restrict specific information based on access control.

To configure MIB views:

config system snmp mib-view
    edit <name>
        set include <OIDs>
        set exclude <OIDs>
    next
end

include <OIDs>	Enter the OID subtrees to be included in the view. A maximum of 16 subtrees can be added.
exclude <OIDs>	Enter the OID subtrees to be excluded in the view. A maximum of 64 subtrees can be added.

To configure access control based on MIB views and VDOMs for SNMP users and communities:

config system snmp user 
    edit <user>
        set mib-view <view>
        set vdoms <vdoms>
    next
end

config system snmp community 
    edit <community>
        set mib-view <view>
        set vdoms <vdoms>
    next
end

mib-view <view>	Set the SNMP access control MIB view.
vdoms <vdoms>	Set the SNMP access control VDOMs.

Example

In this example, two MIB views are created and, with VDOMs, used to control access for SNMP users and communities.

To configure access control for SNMP users and communities:

1. Configure two MIB views:

   config system snmp mib-view
       edit "view1"
           set include "1.3.6.1.2"
       next
       edit "view2"
           set include "1.3.6.1.2.1"
           set exclude "1.3.6.1.2.1.2.1" "1.3.6.1.2.1.4.31" "1.3.6.1.2.1.1.9.1"
       next
   end

2. Add the MIB view and VDOM restrictions to SNMP users:

   config system snmp user
       edit "v3user"
           set mib-view "view1"
       next
       edit "v3user1"
           set vdom "vdom1"
       next
       edit "v3user2"
           set mib-view "view1"
           set vdoms "root" "vdom1"
       next
   end

3. Add the MIB view and VDOM restrictions to SNMP communities:

   config system snmp community
       edit 1
           set name "REGR-SYS"
           set vdoms "vdom1"
       next
       edit 2
           set name "REGR-SYS1"
           set mib-view "view2"
       next
       edit 3
          set name "REGR-SYS2"
          set mib-view "view1"
          set vdoms "root" "vdom1"
       next
   end