Tech-invite3GPPspaceIETFspace
96959493929190898887868584838281807978777675747372717069686766656463626160595857565554535251504948474645444342414039383736353433323130292827262524232221201918171615141312111009080706050403020100
in Index   Prev   Next

RFC 2571

An Architecture for Describing SNMP Management Frameworks

Pages: 62
Obsoletes:  2271
Obsoleted by:  3411
Part 1 of 3 – Pages 1 to 15
None   None   Next

ToP   noToC   RFC2571 - Page 1
Network Working Group                                      D. Harrington
Request for Comments: 2571                       Cabletron Systems, Inc.
Obsoletes: 2271                                               R. Presuhn
Category: Standards Track                             BMC Software, Inc.
                                                               B. Wijnen
                                               IBM T. J. Watson Research
                                                              April 1999


                     An Architecture for Describing
                       SNMP Management Frameworks

Status of this Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (1999).  All Rights Reserved.

Abstract

This document describes an architecture for describing SNMP Management Frameworks. The architecture is designed to be modular to allow the evolution of the SNMP protocol standards over time. The major portions of the architecture are an SNMP engine containing a Message Processing Subsystem, a Security Subsystem and an Access Control Subsystem, and possibly multiple SNMP applications which provide specific functional processing of management data.

Table of Contents

1. Introduction ................................................ 4 1.1. Overview .................................................. 4 1.2. SNMP ...................................................... 4 1.3. Goals of this Architecture ................................ 5 1.4. Security Requirements of this Architecture ................ 6 1.5. Design Decisions .......................................... 7 2. Documentation Overview ...................................... 9 2.1. Document Roadmap .......................................... 10 2.2. Applicability Statement ................................... 10 2.3. Coexistence and Transition ................................ 10 2.4. Transport Mappings ........................................ 11 2.5. Message Processing ........................................ 11
ToP   noToC   RFC2571 - Page 2
   2.6. Security ..................................................   11
   2.7. Access Control ............................................   12
   2.8. Protocol Operations .......................................   12
   2.9. Applications ..............................................   13
   2.10. Structure of Management Information ......................   14
   2.11. Textual Conventions ......................................   14
   2.12. Conformance Statements ...................................   14
   2.13. Management Information Base Modules ......................   14
   2.13.1. SNMP Instrumentation MIBs ..............................   14
   2.14. SNMP Framework Documents .................................   14
   3. Elements of the Architecture ................................   15
   3.1. The Naming of Entities ....................................   16
   3.1.1. SNMP engine .............................................   17
   3.1.1.1. snmpEngineID ..........................................   17
   3.1.1.2. Dispatcher ............................................   17
   3.1.1.3. Message Processing Subsystem ..........................   18
   3.1.1.3.1. Message Processing Model ............................   18
   3.1.1.4. Security Subsystem ....................................   18
   3.1.1.4.1. Security Model ......................................   19
   3.1.1.4.2. Security Protocol ...................................   19
   3.1.2. Access Control Subsystem ................................   19
   3.1.2.1. Access Control Model ..................................   20
   3.1.3. Applications ............................................   20
   3.1.3.1. SNMP Manager ..........................................   20
   3.1.3.2. SNMP Agent ............................................   22
   3.2. The Naming of Identities ..................................   23
   3.2.1. Principal ...............................................   23
   3.2.2. securityName ............................................   23
   3.2.3. Model-dependent security ID .............................   24
   3.3. The Naming of Management Information ......................   25
   3.3.1. An SNMP Context .........................................   26
   3.3.2. contextEngineID .........................................   26
   3.3.3. contextName .............................................   27
   3.3.4. scopedPDU ...............................................   27
   3.4. Other Constructs ..........................................   27
   3.4.1. maxSizeResponseScopedPDU ................................   27
   3.4.2. Local Configuration Datastore ...........................   27
   3.4.3. securityLevel ...........................................   27
   4. Abstract Service Interfaces .................................   28
   4.1. Dispatcher Primitives .....................................   28
   4.1.1. Generate Outgoing Request or Notification ...............   28
   4.1.2. Process Incoming Request or Notification PDU ............   29
   4.1.3. Generate Outgoing Response ..............................   29
   4.1.4. Process Incoming Response PDU ...........................   29
   4.1.5. Registering Responsibility for Handling SNMP PDUs .......   30
   4.2. Message Processing Subsystem Primitives ...................   30
   4.2.1. Prepare Outgoing SNMP Request or Notification Message ...   31
   4.2.2. Prepare an Outgoing SNMP Response Message ...............   31
ToP   noToC   RFC2571 - Page 3
   4.2.3. Prepare Data Elements from an Incoming SNMP Message .....   32
   4.3. Access Control Subsystem Primitives .......................   32
   4.4. Security Subsystem Primitives .............................   33
   4.4.1. Generate a Request or Notification Message ..............   33
   4.4.2. Process Incoming Message ................................   33
   4.4.3. Generate a Response Message .............................   34
   4.5. Common Primitives .........................................   34
   4.5.1. Release State Reference Information .....................   35
   4.6. Scenario Diagrams .........................................   36
   4.6.1. Command Generator or Notification Originator ............   36
   4.6.2. Scenario Diagram for a Command Responder Application ....   37
   5. Managed Object Definitions for SNMP Management Frameworks ...   38
   6. IANA Considerations .........................................   48
   6.1. Security Models ...........................................   48
   6.2. Message Processing Models .................................   48
   6.3. SnmpEngineID Formats ......................................   49
   7. Intellectual Property .......................................   49
   8. Acknowledgements ............................................   49
   9. Security Considerations .....................................   51
   10. References .................................................   52
   11. Editor's Addresses .........................................   54
   A. Guidelines for Model Designers ..............................   55
   A.1. Security Model Design Requirements ........................   55
   A.1.1. Threats .................................................   55
   A.1.2. Security Processing .....................................   56
   A.1.3. Validate the security-stamp in a received message .......   56
   A.1.4. Security MIBs ...........................................   57
   A.1.5. Cached Security Data ....................................   57
   A.2. Message Processing Model Design Requirements ..............   57
   A.2.1. Receiving an SNMP Message from the Network ..............   58
   A.2.2. Sending an SNMP Message to the Network ..................   58
   A.3. Application Design Requirements ...........................   59
   A.3.1. Applications that Initiate Messages .....................   59
   A.3.2. Applications that Receive Responses .....................   59
   A.3.3. Applications that Receive Asynchronous Messages .........   60
   A.3.4. Applications that Send Responses ........................   60
   A.4. Access Control Model Design Requirements ..................   60
   B. Full Copyright Statement ....................................   62
ToP   noToC   RFC2571 - Page 4

1. Introduction

1.1. Overview

This document defines a vocabulary for describing SNMP Management Frameworks, and an architecture for describing the major portions of SNMP Management Frameworks. This document does not provide a general introduction to SNMP. Other documents and books can provide a much better introduction to SNMP. Nor does this document provide a history of SNMP. That also can be found in books and other documents. Section 1 describes the purpose, goals, and design decisions of this architecture. Section 2 describes various types of documents which define (elements of) SNMP Frameworks, and how they fit into this architecture. It also provides a minimal road map to the documents which have previously defined SNMP frameworks. Section 3 details the vocabulary of this architecture and its pieces. This section is important for understanding the remaining sections, and for understanding documents which are written to fit within this architecture. Section 4 describes the primitives used for the abstract service interfaces between the various subsystems, models and applications within this architecture. Section 5 defines a collection of managed objects used to instrument SNMP entities within this architecture. Sections 6, 7, 8, 9, 10 and 11 are administrative in nature. Appendix A contains guidelines for designers of Models which are expected to fit within this architecture. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119].

1.2. SNMP

An SNMP management system contains: - several (potentially many) nodes, each with an SNMP entity containing command responder and notification originator
ToP   noToC   RFC2571 - Page 5
         applications, which have access to management instrumentation
         (traditionally called agents);

      -  at least one SNMP entity containing command generator and/or
         notification receiver applications (traditionally called a
         manager) and,

      -  a management protocol, used to convey management information
         between the SNMP entities.

   SNMP entities executing command generator and notification receiver
   applications monitor and control managed elements.  Managed elements
   are devices such as hosts, routers, terminal servers, etc., which are
   monitored and controlled via access to their management information.

   It is the purpose of this document to define an architecture which
   can evolve to realize effective management in a variety of
   configurations and environments. The architecture has been designed
   to meet the needs of implementations of:

      -  minimal SNMP entities with command responder and/or
         notification originator applications (traditionally called SNMP
         agents),

      -  SNMP entities with proxy forwarder applications (traditionally
         called SNMP proxy agents),

      -  command line driven SNMP entities with command generator and/or
         notification receiver applications (traditionally called SNMP
         command line managers),

      -  SNMP entities with  command generator and/or notification
         receiver, plus command responder and/or notification originator
         applications (traditionally called SNMP mid-level managers or
         dual-role entities),

      -  SNMP entities with command generator and/or notification
         receiver and possibly other types of applications for managing
         a potentially very large number of managed nodes (traditionally
         called (network) management stations).

1.3. Goals of this Architecture

This architecture was driven by the following goals: - Use existing materials as much as possible. It is heavily based on previous work, informally known as SNMPv2u and SNMPv2*, based in turn on SNMPv2p.
ToP   noToC   RFC2571 - Page 6
      -  Address the need for secure SET support, which is considered
         the most important deficiency in SNMPv1 and SNMPv2c.

      -  Make it possible to move portions of the architecture forward
         in the standards track, even if consensus has not been reached
         on all pieces.

      -  Define an architecture that allows for longevity of the SNMP
         Frameworks that have been and will be defined.

      -  Keep SNMP as simple as possible.

      -  Make it relatively inexpensive to deploy a minimal conforming
         implementation.

      -  Make it possible to upgrade portions of SNMP as new approaches
         become available, without disrupting an entire SNMP framework.

      -  Make it possible to support features required in large
         networks, but make the expense of supporting a feature directly
         related to the support of the feature.

1.4. Security Requirements of this Architecture

Several of the classical threats to network protocols are applicable to the management problem and therefore would be applicable to any Security Model used in an SNMP Management Framework. Other threats are not applicable to the management problem. This section discusses principal threats, secondary threats, and threats which are of lesser importance. The principal threats against which any Security Model used within this architecture SHOULD provide protection are: Modification of Information The modification threat is the danger that some unauthorized entity may alter in-transit SNMP messages generated on behalf of an authorized principal in such a way as to effect unauthorized management operations, including falsifying the value of an object. Masquerade The masquerade threat is the danger that management operations not authorized for some principal may be attempted by assuming the identity of another principal that has the appropriate authorizations.
ToP   noToC   RFC2571 - Page 7
   Secondary threats against which any Security Model used within this
   architecture SHOULD provide protection are:

      Message Stream Modification
         The SNMP protocol is typically based upon a connectionless
         transport service which may operate over any subnetwork
         service.  The re-ordering, delay or replay of messages can and
         does occur through the natural operation of many such
         subnetwork services.  The message stream modification threat is
         the danger that messages may be maliciously re-ordered, delayed
         or replayed to an extent which is greater than can occur
         through the natural operation of a subnetwork service, in order
         to effect unauthorized management operations.

      Disclosure
         The disclosure threat is the danger of eavesdropping on the
         exchanges between SNMP engines.  Protecting against this threat
         may be required as a matter of local policy.

   There are at least two threats against which a Security Model within
   this architecture need not protect, since they are deemed to be of
   lesser importance in this context:

      Denial of Service
         A Security Model need not attempt to address the broad range of
         attacks by which service on behalf of authorized users is
         denied.  Indeed, such denial-of-service attacks are in many
         cases indistinguishable from the type of network failures with
         which any viable management protocol must cope as a matter of
         course.

      Traffic Analysis
         A Security Model need not attempt to address traffic analysis
         attacks.  Many traffic patterns are predictable - entities may
         be managed on a regular basis by a relatively small number of
         management stations - and therefore there is no significant
         advantage afforded by protecting against traffic analysis.

1.5. Design Decisions

Various design decisions were made in support of the goals of the architecture and the security requirements: - Architecture An architecture should be defined which identifies the conceptual boundaries between the documents. Subsystems should be defined which describe the abstract services provided by specific portions of an SNMP framework. Abstract service
ToP   noToC   RFC2571 - Page 8
         interfaces, as described by service primitives, define the
         abstract boundaries between documents, and the abstract
         services that are provided by the conceptual subsystems of an
         SNMP framework.

      - Self-contained Documents
         Elements of procedure plus the MIB objects which are needed for
         processing for a specific portion of an SNMP framework should
         be defined in the same document, and as much as possible,
         should not be referenced in other documents. This allows pieces
         to be designed and documented as independent and self-contained
         parts, which is consistent with the general SNMP MIB module
         approach.  As portions of SNMP change over time, the documents
         describing other portions of SNMP are not directly impacted.
         This modularity allows, for example, Security Models,
         authentication and privacy mechanisms, and message formats to
         be upgraded and supplemented as the need arises. The self-
         contained documents can move along the standards track on
         different time-lines.

      This modularity of specification is not meant to be interpreted as
      imposing any specific requirements on implementation.

      - Threats
         The Security Models in the Security Subsystem SHOULD protect
         against the principal and secondary threats: modification of
         information, masquerade, message stream modification and
         disclosure.  They do not need to protect against denial of
         service and traffic analysis.

      - Remote Configuration
         The Security and Access Control Subsystems add a whole new set
         of SNMP configuration parameters.  The Security Subsystem also
         requires frequent changes of secrets at the various SNMP
         entities. To make this deployable in a large operational
         environment, these SNMP parameters must be remotely
         configurable.

      - Controlled Complexity
         It is recognized that producers of simple managed devices want
         to keep the resources used by SNMP to a minimum.  At the same
         time, there is a need for more complex configurations which can
         spend more resources for SNMP and thus provide more
         functionality.  The design tries to keep the competing
         requirements of these two environments in balance and allows
         the more complex environments to logically extend the simple
         environment.
ToP   noToC   RFC2571 - Page 9

2. Documentation Overview

The following figure shows the set of documents that fit within the SNMP Architecture. +------------------------- Document Set ----------------------------+ | | | +----------+ +-----------------+ +----------------+ | | | Document | | Applicability * | | Coexistence | | | | Roadmap | | Statement | | & Transition | | | +----------+ +-----------------+ +----------------+ | | | | +---------------------------------------------------------------+ | | | Message Handling | | | | +----------------+ +-----------------+ +-----------------+ | | | | | Transport | | Message | | Security | | | | | | Mappings | | Processing and | | | | | | | | | | Dispatcher | | | | | | | +----------------+ +-----------------+ +-----------------+ | | | +---------------------------------------------------------------+ | | | | +---------------------------------------------------------------+ | | | PDU Handling | | | | +----------------+ +-----------------+ +-----------------+ | | | | | Protocol | | Applications | | Access | | | | | | Operations | | | | Control | | | | | +----------------+ +-----------------+ +-----------------+ | | | +---------------------------------------------------------------+ | | | | +---------------------------------------------------------------+ | | | Information Model | | | | +--------------+ +--------------+ +---------------+ | | | | | Structure of | | Textual | | Conformance | | | | | | Management | | Conventions | | Statements | | | | | | Information | | | | | | | | | +--------------+ +--------------+ +---------------+ | | | +---------------------------------------------------------------+ | | | | +---------------------------------------------------------------+ | | | MIB Modules written in various formats, e.g.: | | | | +-------------+ +-------------+ +----------+ +----------+ | | | | | Standard v1 | | Standard v1 | | Historic | | Draft v2 | | | | | | RFC 1157 | | RFC 1212 | | RFC 14xx | | RFC 19xx | | | | | | format | | format | | format | | format | | | | | +-------------+ +-------------+ +----------+ +----------+ | | | +---------------------------------------------------------------+ | | | +-------------------------------------------------------------------+
ToP   noToC   RFC2571 - Page 10
   Those marked with an asterisk (*) are expected to be written in the
   future. Each of these documents may be replaced or supplemented.
   This Architecture document specifically describes how new documents
   fit into the set of documents in the area of Message and PDU
   handling.


2.1. Document Roadmap

One or more documents may be written to describe how sets of documents taken together form specific Frameworks. The configuration of document sets might change over time, so the "road map" should be maintained in a document separate from the standards documents themselves. An example of such a roadmap is "Introduction to Version 3 of the Internet-standard Network Management Framework" [RFC2570].

2.2. Applicability Statement

SNMP is used in networks that vary widely in size and complexity, by organizations that vary widely in their requirements of management. Some models will be designed to address specific problems of management, such as message security. One or more documents may be written to describe the environments to which certain versions of SNMP or models within SNMP would be appropriately applied, and those to which a given model might be inappropriately applied.

2.3. Coexistence and Transition

The purpose of an evolutionary architecture is to permit new models to replace or supplement existing models. The interactions between models could result in incompatibilities, security "holes", and other undesirable effects. The purpose of Coexistence documents is to detail recognized anomalies and to describe required and recommended behaviors for resolving the interactions between models within the architecture. Coexistence documents may be prepared separately from model definition documents, to describe and resolve interaction anomalies between a model definition and one or more other model definitions. Additionally, recommendations for transitions between models may also be described, either in a coexistence document or in a separate document.
ToP   noToC   RFC2571 - Page 11
   One such coexistance document is [SNMP-COEX], "Coexistence between
   Version 1, Version 2, and Version 3 of the Internet-standard Network
   Management Framework".

2.4. Transport Mappings

SNMP messages are sent over various transports. It is the purpose of Transport Mapping documents to define how the mapping between SNMP and the transport is done.

2.5. Message Processing

A Message Processing Model document defines a message format, which is typically identified by a version field in an SNMP message header. The document may also define a MIB module for use in message processing and for instrumentation of version-specific interactions. An SNMP engine includes one or more Message Processing Models, and thus may support sending and receiving multiple versions of SNMP messages.

2.6. Security

Some environments require secure protocol interactions. Security is normally applied at two different stages: - in the transmission/receipt of messages, and - in the processing of the contents of messages. For purposes of this document, "security" refers to message-level security; "access control" refers to the security applied to protocol operations. Authentication, encryption, and timeliness checking are common functions of message level security. A security document describes a Security Model, the threats against which the model protects, the goals of the Security Model, the protocols which it uses to meet those goals, and it may define a MIB module to describe the data used during processing, and to allow the remote configuration of message-level security parameters, such as keys. An SNMP engine may support multiple Security Models concurrently.
ToP   noToC   RFC2571 - Page 12

2.7. Access Control

During processing, it may be required to control access to managed objects for operations. An Access Control Model defines mechanisms to determine whether access to a managed object should be allowed. An Access Control Model may define a MIB module used during processing and to allow the remote configuration of access control policies.

2.8. Protocol Operations

SNMP messages encapsulate an SNMP Protocol Data Unit (PDU). SNMP PDUs define the operations performed by the receiving SNMP engine. It is the purpose of a Protocol Operations document to define the operations of the protocol with respect to the processing of the PDUs. Every PDU belongs to one or more of the PDU classes defined below: 1) Read Class: The Read Class contains protocol operations that retrieve management information. For example, RFC 1905 defines the following protocol operations for the Read Class: GetRequest- PDU, GetNextRequest-PDU, and GetBulkRequest-PDU. 2) Write Class: The Write Class contains protocol operations which attempt to modify management information. For example, RFC 1905 defines the following protocol operation for the Write Class: SetRequest-PDU. 3) Response Class: The Response Class contains protocol operations which are sent in response to a previous request. For example, RFC 1905 defines the following for the Response Class: Response-PDU, Report-PDU. 4) Notification Class: The Notification Class contains protocol operations which send a notification to a notification receiver application. For example, RFC 1905 defines the following operations for the Notification Class: Trapv2-PDU, InformRequest-PDU.
ToP   noToC   RFC2571 - Page 13
      5) Internal Class:

         The Internal Class contains protocol operations which are
         exchanged internally between SNMP engines.  For example, RFC
         1905 defines the following operations for the Internal Class:
         Report-PDU.

   The preceding five classifications are based on the functional
   properties of a PDU. It is also useful to classify PDUs based on
   whether a response is expected:

      6) Confirmed Class:

         The Confirmed Class contains all protocol operations which
         cause the receiving SNMP engine to send back a response.  For
         example, RFC 1905 defines the following operations for the
         Confirmed Class:  GetRequest-PDU, GetNextRequest-PDU,
         GetBulkRequest-PDU, SetRequest-PDU, and InformRequest-PDU.

      7) Unconfirmed Class:

         The Unconfirmed Class contains all protocol operations which
         are not acknowledged. For example, RFC 1905 defines the
         following operations for the Unconfirmed Class:  Report-PDU,
         Trapv2-PDU, and GetResponse-PDU.

   An application document defines which Protocol Operations are
   supported by the application.

2.9. Applications

An SNMP entity normally includes a number of applications. Applications use the services of an SNMP engine to accomplish specific tasks. They coordinate the processing of management information operations, and may use SNMP messages to communicate with other SNMP entities. Applications documents describe the purpose of an application, the services required of the associated SNMP engine, and the protocol operations and informational model that the application uses to perform management operations. An application document defines which set of documents are used to specifically define the structure of management information, textual conventions, conformance requirements, and operations supported by the application.
ToP   noToC   RFC2571 - Page 14

2.10. Structure of Management Information

Management information is viewed as a collection of managed objects, residing in a virtual information store, termed the Management Information Base (MIB). Collections of related objects are defined in MIB modules. It is the purpose of a Structure of Management Information document to establish the notation for defining objects, modules, and other elements of managed information.

2.11. Textual Conventions

When designing a MIB module, it is often useful to define new types similar to those defined in the SMI, but with more precise semantics, or which have special semantics associated with them. These newly defined types are termed textual conventions, and may be defined in separate documents, or within a MIB module.

2.12. Conformance Statements

It may be useful to define the acceptable lower-bounds of implementation, along with the actual level of implementation achieved. It is the purpose of the Conformance Statements document to define the notation used for these purposes.

2.13. Management Information Base Modules

MIB documents describe collections of managed objects which instrument some aspect of a managed node.

2.13.1. SNMP Instrumentation MIBs

An SNMP MIB document may define a collection of managed objects which instrument the SNMP protocol itself. In addition, MIB modules may be defined within the documents which describe portions of the SNMP architecture, such as the documents for Message processing Models, Security Models, etc. for the purpose of instrumenting those Models, and for the purpose of allowing remote configuration of the Model.

2.14. SNMP Framework Documents

This architecture is designed to allow an orderly evolution of portions of SNMP Frameworks. Throughout the rest of this document, the term "subsystem" refers to an abstract and incomplete specification of a portion of a Framework, that is further refined by a model specification.
ToP   noToC   RFC2571 - Page 15
   A "model" describes a specific design of a subsystem, defining
   additional constraints and rules for conformance to the model.  A
   model is sufficiently detailed to make it possible to implement the
   specification.

   An "implementation" is an instantiation of a subsystem, conforming to
   one or more specific models.

   SNMP version 1 (SNMPv1), is the original Internet-standard Network
   Management Framework, as described in RFCs 1155, 1157, and 1212.

   SNMP version 2 (SNMPv2), is the SNMPv2 Framework as derived from the
   SNMPv1 Framework. It is described in STD 58, RFCs 2578, 2579, 2580,
   and RFCs 1905-1907. SNMPv2 has no message definition.

   The Community-based SNMP version 2 (SNMPv2c), is an experimental SNMP
   Framework which supplements the SNMPv2 Framework, as described in RFC
   1901. It adds the SNMPv2c message format, which is similar to the
   SNMPv1 message format.

   SNMP version 3 (SNMPv3), is an extensible SNMP Framework which
   supplements the SNMPv2 Framework, by supporting the following:

      -  a new SNMP message format,

      -  Security for Messages,

      -  Access Control, and

      -  Remote configuration of SNMP parameters.

   Other SNMP Frameworks, i.e., other configurations of implemented
   subsystems, are expected to also be consistent with this
   architecture.



(page 15 continued on part 2)

Next Section