Network Working Group D. Harrington
Request for Comments: 2571 Cabletron Systems, Inc.
Obsoletes: 2271 R. Presuhn
Category: Standards Track BMC Software, Inc.
IBM T. J. Watson Research
April 1999 An Architecture for Describing
SNMP Management Frameworks
Status of this Memo
This document specifies an Internet standards track protocol for the
Internet community, and requests discussion and suggestions for
improvements. Please refer to the current edition of the "Internet
Official Protocol Standards" (STD 1) for the standardization state
and status of this protocol. Distribution of this memo is unlimited.
Copyright (C) The Internet Society (1999). All Rights Reserved.
This document describes an architecture for describing SNMP
Management Frameworks. The architecture is designed to be modular to
allow the evolution of the SNMP protocol standards over time. The
major portions of the architecture are an SNMP engine containing a
Message Processing Subsystem, a Security Subsystem and an Access
Control Subsystem, and possibly multiple SNMP applications which
provide specific functional processing of management data.
Table of Contents
1. Introduction ................................................ 41.1. Overview .................................................. 41.2. SNMP ...................................................... 41.3. Goals of this Architecture ................................ 51.4. Security Requirements of this Architecture ................ 61.5. Design Decisions .......................................... 72. Documentation Overview ...................................... 92.1. Document Roadmap .......................................... 102.2. Applicability Statement ................................... 102.3. Coexistence and Transition ................................ 102.4. Transport Mappings ........................................ 112.5. Message Processing ........................................ 11
This document defines a vocabulary for describing SNMP Management
Frameworks, and an architecture for describing the major portions of
SNMP Management Frameworks.
This document does not provide a general introduction to SNMP. Other
documents and books can provide a much better introduction to SNMP.
Nor does this document provide a history of SNMP. That also can be
found in books and other documents.
Section 1 describes the purpose, goals, and design decisions of this
Section 2 describes various types of documents which define (elements
of) SNMP Frameworks, and how they fit into this architecture. It also
provides a minimal road map to the documents which have previously
defined SNMP frameworks.
Section 3 details the vocabulary of this architecture and its pieces.
This section is important for understanding the remaining sections,
and for understanding documents which are written to fit within this
Section 4 describes the primitives used for the abstract service
interfaces between the various subsystems, models and applications
within this architecture.
Section 5 defines a collection of managed objects used to instrument
SNMP entities within this architecture.
Sections 6, 7, 8, 9, 10 and 11 are administrative in nature.
Appendix A contains guidelines for designers of Models which are
expected to fit within this architecture.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119].
An SNMP management system contains:
- several (potentially many) nodes, each with an SNMP entity
containing command responder and notification originator
applications, which have access to management instrumentation
(traditionally called agents);
- at least one SNMP entity containing command generator and/or
notification receiver applications (traditionally called a
- a management protocol, used to convey management information
between the SNMP entities.
SNMP entities executing command generator and notification receiver
applications monitor and control managed elements. Managed elements
are devices such as hosts, routers, terminal servers, etc., which are
monitored and controlled via access to their management information.
It is the purpose of this document to define an architecture which
can evolve to realize effective management in a variety of
configurations and environments. The architecture has been designed
to meet the needs of implementations of:
- minimal SNMP entities with command responder and/or
notification originator applications (traditionally called SNMP
- SNMP entities with proxy forwarder applications (traditionally
called SNMP proxy agents),
- command line driven SNMP entities with command generator and/or
notification receiver applications (traditionally called SNMP
command line managers),
- SNMP entities with command generator and/or notification
receiver, plus command responder and/or notification originator
applications (traditionally called SNMP mid-level managers or
- SNMP entities with command generator and/or notification
receiver and possibly other types of applications for managing
a potentially very large number of managed nodes (traditionally
called (network) management stations).
1.3. Goals of this Architecture
This architecture was driven by the following goals:
- Use existing materials as much as possible. It is heavily based
on previous work, informally known as SNMPv2u and SNMPv2*,
based in turn on SNMPv2p.
- Address the need for secure SET support, which is considered
the most important deficiency in SNMPv1 and SNMPv2c.
- Make it possible to move portions of the architecture forward
in the standards track, even if consensus has not been reached
on all pieces.
- Define an architecture that allows for longevity of the SNMP
Frameworks that have been and will be defined.
- Keep SNMP as simple as possible.
- Make it relatively inexpensive to deploy a minimal conforming
- Make it possible to upgrade portions of SNMP as new approaches
become available, without disrupting an entire SNMP framework.
- Make it possible to support features required in large
networks, but make the expense of supporting a feature directly
related to the support of the feature.
1.4. Security Requirements of this Architecture
Several of the classical threats to network protocols are applicable
to the management problem and therefore would be applicable to any
Security Model used in an SNMP Management Framework. Other threats
are not applicable to the management problem. This section discusses
principal threats, secondary threats, and threats which are of lesser
The principal threats against which any Security Model used within
this architecture SHOULD provide protection are:
Modification of Information
The modification threat is the danger that some unauthorized
entity may alter in-transit SNMP messages generated on behalf
of an authorized principal in such a way as to effect
unauthorized management operations, including falsifying the
value of an object.
The masquerade threat is the danger that management operations
not authorized for some principal may be attempted by assuming
the identity of another principal that has the appropriate
Secondary threats against which any Security Model used within this
architecture SHOULD provide protection are:
Message Stream Modification
The SNMP protocol is typically based upon a connectionless
transport service which may operate over any subnetwork
service. The re-ordering, delay or replay of messages can and
does occur through the natural operation of many such
subnetwork services. The message stream modification threat is
the danger that messages may be maliciously re-ordered, delayed
or replayed to an extent which is greater than can occur
through the natural operation of a subnetwork service, in order
to effect unauthorized management operations.
The disclosure threat is the danger of eavesdropping on the
exchanges between SNMP engines. Protecting against this threat
may be required as a matter of local policy.
There are at least two threats against which a Security Model within
this architecture need not protect, since they are deemed to be of
lesser importance in this context:
Denial of Service
A Security Model need not attempt to address the broad range of
attacks by which service on behalf of authorized users is
denied. Indeed, such denial-of-service attacks are in many
cases indistinguishable from the type of network failures with
which any viable management protocol must cope as a matter of
A Security Model need not attempt to address traffic analysis
attacks. Many traffic patterns are predictable - entities may
be managed on a regular basis by a relatively small number of
management stations - and therefore there is no significant
advantage afforded by protecting against traffic analysis.
1.5. Design Decisions
Various design decisions were made in support of the goals of the
architecture and the security requirements:
An architecture should be defined which identifies the
conceptual boundaries between the documents. Subsystems should
be defined which describe the abstract services provided by
specific portions of an SNMP framework. Abstract service
interfaces, as described by service primitives, define the
abstract boundaries between documents, and the abstract
services that are provided by the conceptual subsystems of an
- Self-contained Documents
Elements of procedure plus the MIB objects which are needed for
processing for a specific portion of an SNMP framework should
be defined in the same document, and as much as possible,
should not be referenced in other documents. This allows pieces
to be designed and documented as independent and self-contained
parts, which is consistent with the general SNMP MIB module
approach. As portions of SNMP change over time, the documents
describing other portions of SNMP are not directly impacted.
This modularity allows, for example, Security Models,
authentication and privacy mechanisms, and message formats to
be upgraded and supplemented as the need arises. The self-
contained documents can move along the standards track on
This modularity of specification is not meant to be interpreted as
imposing any specific requirements on implementation.
The Security Models in the Security Subsystem SHOULD protect
against the principal and secondary threats: modification of
information, masquerade, message stream modification and
disclosure. They do not need to protect against denial of
service and traffic analysis.
- Remote Configuration
The Security and Access Control Subsystems add a whole new set
of SNMP configuration parameters. The Security Subsystem also
requires frequent changes of secrets at the various SNMP
entities. To make this deployable in a large operational
environment, these SNMP parameters must be remotely
- Controlled Complexity
It is recognized that producers of simple managed devices want
to keep the resources used by SNMP to a minimum. At the same
time, there is a need for more complex configurations which can
spend more resources for SNMP and thus provide more
functionality. The design tries to keep the competing
requirements of these two environments in balance and allows
the more complex environments to logically extend the simple
Those marked with an asterisk (*) are expected to be written in the
future. Each of these documents may be replaced or supplemented.
This Architecture document specifically describes how new documents
fit into the set of documents in the area of Message and PDU
2.1. Document Roadmap
One or more documents may be written to describe how sets of
documents taken together form specific Frameworks. The configuration
of document sets might change over time, so the "road map" should be
maintained in a document separate from the standards documents
An example of such a roadmap is "Introduction to Version 3 of the
Internet-standard Network Management Framework" [RFC2570].
2.2. Applicability Statement
SNMP is used in networks that vary widely in size and complexity, by
organizations that vary widely in their requirements of management.
Some models will be designed to address specific problems of
management, such as message security.
One or more documents may be written to describe the environments to
which certain versions of SNMP or models within SNMP would be
appropriately applied, and those to which a given model might be
2.3. Coexistence and Transition
The purpose of an evolutionary architecture is to permit new models
to replace or supplement existing models. The interactions between
models could result in incompatibilities, security "holes", and other
The purpose of Coexistence documents is to detail recognized
anomalies and to describe required and recommended behaviors for
resolving the interactions between models within the architecture.
Coexistence documents may be prepared separately from model
definition documents, to describe and resolve interaction anomalies
between a model definition and one or more other model definitions.
Additionally, recommendations for transitions between models may also
be described, either in a coexistence document or in a separate
One such coexistance document is [SNMP-COEX], "Coexistence between
Version 1, Version 2, and Version 3 of the Internet-standard Network
2.4. Transport Mappings
SNMP messages are sent over various transports. It is the purpose of
Transport Mapping documents to define how the mapping between SNMP
and the transport is done.
2.5. Message Processing
A Message Processing Model document defines a message format, which
is typically identified by a version field in an SNMP message header.
The document may also define a MIB module for use in message
processing and for instrumentation of version-specific interactions.
An SNMP engine includes one or more Message Processing Models, and
thus may support sending and receiving multiple versions of SNMP
Some environments require secure protocol interactions. Security is
normally applied at two different stages:
- in the transmission/receipt of messages, and
- in the processing of the contents of messages.
For purposes of this document, "security" refers to message-level
security; "access control" refers to the security applied to protocol
Authentication, encryption, and timeliness checking are common
functions of message level security.
A security document describes a Security Model, the threats against
which the model protects, the goals of the Security Model, the
protocols which it uses to meet those goals, and it may define a MIB
module to describe the data used during processing, and to allow the
remote configuration of message-level security parameters, such as
An SNMP engine may support multiple Security Models concurrently.
2.7. Access Control
During processing, it may be required to control access to managed
objects for operations.
An Access Control Model defines mechanisms to determine whether
access to a managed object should be allowed. An Access Control
Model may define a MIB module used during processing and to allow the
remote configuration of access control policies.
2.8. Protocol Operations
SNMP messages encapsulate an SNMP Protocol Data Unit (PDU). SNMP
PDUs define the operations performed by the receiving SNMP engine.
It is the purpose of a Protocol Operations document to define the
operations of the protocol with respect to the processing of the
PDUs. Every PDU belongs to one or more of the PDU classes defined
1) Read Class:
The Read Class contains protocol operations that retrieve
management information. For example, RFC 1905 defines the
following protocol operations for the Read Class: GetRequest-
PDU, GetNextRequest-PDU, and GetBulkRequest-PDU.
2) Write Class:
The Write Class contains protocol operations which attempt to
modify management information. For example, RFC 1905 defines
the following protocol operation for the Write Class:
3) Response Class:
The Response Class contains protocol operations which are sent
in response to a previous request. For example, RFC 1905
defines the following for the Response Class: Response-PDU,
4) Notification Class:
The Notification Class contains protocol operations which send
a notification to a notification receiver application. For
example, RFC 1905 defines the following operations for the
Notification Class: Trapv2-PDU, InformRequest-PDU.
5) Internal Class:
The Internal Class contains protocol operations which are
exchanged internally between SNMP engines. For example, RFC
1905 defines the following operations for the Internal Class:
The preceding five classifications are based on the functional
properties of a PDU. It is also useful to classify PDUs based on
whether a response is expected:
6) Confirmed Class:
The Confirmed Class contains all protocol operations which
cause the receiving SNMP engine to send back a response. For
example, RFC 1905 defines the following operations for the
Confirmed Class: GetRequest-PDU, GetNextRequest-PDU,
GetBulkRequest-PDU, SetRequest-PDU, and InformRequest-PDU.
7) Unconfirmed Class:
The Unconfirmed Class contains all protocol operations which
are not acknowledged. For example, RFC 1905 defines the
following operations for the Unconfirmed Class: Report-PDU,
Trapv2-PDU, and GetResponse-PDU.
An application document defines which Protocol Operations are
supported by the application.
An SNMP entity normally includes a number of applications.
Applications use the services of an SNMP engine to accomplish
specific tasks. They coordinate the processing of management
information operations, and may use SNMP messages to communicate with
other SNMP entities.
Applications documents describe the purpose of an application, the
services required of the associated SNMP engine, and the protocol
operations and informational model that the application uses to
perform management operations.
An application document defines which set of documents are used to
specifically define the structure of management information, textual
conventions, conformance requirements, and operations supported by
2.10. Structure of Management Information
Management information is viewed as a collection of managed objects,
residing in a virtual information store, termed the Management
Information Base (MIB). Collections of related objects are defined in
It is the purpose of a Structure of Management Information document
to establish the notation for defining objects, modules, and other
elements of managed information.
2.11. Textual Conventions
When designing a MIB module, it is often useful to define new types
similar to those defined in the SMI, but with more precise semantics,
or which have special semantics associated with them. These newly
defined types are termed textual conventions, and may be defined in
separate documents, or within a MIB module.
2.12. Conformance Statements
It may be useful to define the acceptable lower-bounds of
implementation, along with the actual level of implementation
achieved. It is the purpose of the Conformance Statements document to
define the notation used for these purposes.
2.13. Management Information Base Modules
MIB documents describe collections of managed objects which
instrument some aspect of a managed node.
2.13.1. SNMP Instrumentation MIBs
An SNMP MIB document may define a collection of managed objects which
instrument the SNMP protocol itself. In addition, MIB modules may be
defined within the documents which describe portions of the SNMP
architecture, such as the documents for Message processing Models,
Security Models, etc. for the purpose of instrumenting those Models,
and for the purpose of allowing remote configuration of the Model.
2.14. SNMP Framework Documents
This architecture is designed to allow an orderly evolution of
portions of SNMP Frameworks.
Throughout the rest of this document, the term "subsystem" refers to
an abstract and incomplete specification of a portion of a Framework,
that is further refined by a model specification.
A "model" describes a specific design of a subsystem, defining
additional constraints and rules for conformance to the model. A
model is sufficiently detailed to make it possible to implement the
An "implementation" is an instantiation of a subsystem, conforming to
one or more specific models.
SNMP version 1 (SNMPv1), is the original Internet-standard Network
Management Framework, as described in RFCs 1155, 1157, and 1212.
SNMP version 2 (SNMPv2), is the SNMPv2 Framework as derived from the
SNMPv1 Framework. It is described in STD 58, RFCs 2578, 2579, 2580,
and RFCs 1905-1907. SNMPv2 has no message definition.
The Community-based SNMP version 2 (SNMPv2c), is an experimental SNMP
Framework which supplements the SNMPv2 Framework, as described in RFC
1901. It adds the SNMPv2c message format, which is similar to the
SNMPv1 message format.
SNMP version 3 (SNMPv3), is an extensible SNMP Framework which
supplements the SNMPv2 Framework, by supporting the following:
- a new SNMP message format,
- Security for Messages,
- Access Control, and
- Remote configuration of SNMP parameters.
Other SNMP Frameworks, i.e., other configurations of implemented
subsystems, are expected to also be consistent with this