Re: Question about SNMPv3 authentication

>>>>> On Fri, 18 Jun 2010 18:43:42 -0700 (PDT), "Zaryab M. Munir" <[email protected]> said:

ZMM> I suspect that the values of "msgAuthoritativeEngineBoots"  and 
ZMM> "msgAuthoritativeEngineTime"  change drastically when the standby
ZMM> agent becomes active.  As the newly active agent and the previous
ZMM> Active agent has the same EngineID,  the manager does not do a new 
ZMM> "Agent Discovery" and the snmpv3 fails due to a big change in the
ZMM> msgAuthoritativeEngineBoots  and  msgAuthoritativeEngineTime.    Am
ZMM> I correct ?    Will this problem be resolved if the standby agent
ZMM> is configured with a different snmpEngineID ?

That's almost certainly the problem.  It's likely that the manager may
work switching one direction (from the engine with the older boots/time
to the one with the newer value), but it is against the V3/USM specs to
go the opposite direction (for good security reasons).

Using two different engineIDs is definitely the right thing to do
*unless* the manager is one that caches information associated with the
IP address.  If the managers memorizes engineID A as belonging to IP
Address A and it changes strange things could happen.  If you are in
control of the manager you can try using different engines and see what
happens.

-- 
Wes Hardaker
Please mail all replies to [email protected]

------------------------------------------------------------------------------
ThinkGeek and WIRED's GeekDad team up for the Ultimate 
GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the 
lucky parental unit.  See the prize list and enter to win: 
http://p.sf.net/sfu/thinkgeek-promo