SNMP ACL

Hello,

Configure SNMP access control based on ACL.

• Configure ACL rules.

• Specify ACL rules for the SNMP agent, community name,.
  

• Run the snmp-agent acl acl-number command to configure the SNMP ACL. Only the NMS matching the rule can access the switch through the SNMP user.

• Run the snmp-agent community { read | write } { community-name | cipher community-name } acl acl-number command to specify the ACL for SNMP community name. After the command is executed, only the NMS using the specified community name and matching the ACL can access the switch.

Thanks

Hello Sprout,

The SNMP access process is as follows:

Step 1: When other devices access the local through SNMP, the traffic policy on the interface is preferentially matched. No SNMP alarm is generated no matter whether the ACL policy on the interface denies or permits the access.  

Step 2: If the traffic policy on the interface permits the traffic or no policy is configured, the traffic matches the SNMP ACL(the snmp-agent ACL command). In this case, if the access is denied by the ACL, an alarm is generated.  

Step 3: When the SNMP ACL permits the traffic, the community name and password are verified. If the password is incorrect, an alarm is generated. 

Step 4: If the password is correct, the system checks the ACL configured for the community name(the snmp-agent community ACL command ). If the community name is denied by the ACL, an alarm is generated.

From this process, you can see that the ACL matching order in these two commands is different.

Any further questions, let us know!

snmp-agent ACL command:
By default, the SNMP agent function is disabled. Executing the snmp-agent command can enable the SNMP agent function no matter whether parameters are specified in the command.

snmp-agent community ACL
The community name is set.
By default, no community name exists in the system. The community name will be saved in encrypted format in the configuration file.
By default, the device checks complexity of community names. If the check fails, the community name is failed to be configured.
For more info please check below:
https://support.huawei.com/enterprise/en/doc/EDOC1000047422?section=j005

Good answer