SNMP v3 Proxy to SNMP v1 host

Hello,

First - some background information:

My setup is as follows:

host1----->host2(proxy)----->host3

I need host2 to proxy SNMPv3 requests from host1 and map them to a SNMPv1/2c
request to host3. Host3 is only capable of receiving SNMP v1/2c requests and
I need host1 to send encrypted SNMP requests to host2, thus the need for
SNMPv3.

I have a working setup where host1 sends a SNMP v1/2c request to host2 using
one community string and then host2 maps that request to a new community
string and sends that request to host3. The following is my configuration
for that:

*com2sec -Cn mycontext secname_public default host2communitystring*

*access group_public mycontext any noauth exact all none none*

*proxy -Cn mycontext -v 1 -c host3communitystring host3*

This setup allows me to send a SNMP v1/2c request to host2 using the
community string "host2communitystring" where then host2 handles the proxy
to host3 using the community string "host3communitystring3", as per the
following command:

*snmpwalk -v1 -c host2communitystring host2 sysname*
**
I believe this works because of the use of "context". I'm sending the query
to host2 but getting host3 data.

Now, if I update my configuration to have  host2 take an SNMPv3 request and
proxy that to host3 using a SNMPv1/2c request with context, I the whole
thing works as expected. The following is my configuration for this (I have
an SNMPv3 user already created called *ro_snmp_user*):

*group -Cn mycontext mygroup usm ro_snmp_user
*
*access mygroup "" usm auth exact all none none
*
*proxy -Cn mycontext -v 1 -c public host3*
****
If I issue an snmpwalk with the -n flag (for context) from host1 with the
SNMPv3 userame and credentials to host2, host2 successfully proxies the
request to host3 using SNMPv1.

If I issue the command without the -n flag from host1 with the SNMPv3
username and credentials to host2, the data that is returned is host2 data
and nothing is proxied. And so far, this is as expeceted.

So far, I have a working setup, as long as I use "context" in my host2
snmpd.conf file and I use the -n flag specifying the context from host1.

The problem I have with this setup is that my client software on host1
does't have an option to specify a context. I need to be able to send an
SNMPv3 request to host2 without context and have host2 map that request so
that it's proxied to host3, just like how it works in my first example,
where the request from host1 is SNMPv1 and didn't require me to use an -n
flag and specify context.

I'm thinking that to accomplish this, I need to use VACM with USM (SNMPv3);
however, I'm not having any luck with this. I've tried various VACM policies
but everytime I try polling host2 from host1 with an SNMPv3 request, host2
data is also returned and the request is never proxied.

How can I accomplish this without having to use context in my client's SNMP
request? Is VACM the answer?

Thanks,

-- 
Ralph

------------------------------------------------------------------------------
Protect Your Site and Customers from Malware Attacks
Learn about various malware tactics and how to avoid them. Understand 
malware threats, the impact they can have on your business, and how you 
can protect your company and customers by using code signing.
http://p.sf.net/sfu/oracle-sfdevnl

_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users