NM-2020-08-SNMPv3

第三章 网络管理协议（12学时）

教学目的和要求：

了解网络管理协议及其功能；理解SNMP原理，功能和管理控制框架和SNMP发展过程；了解远程网络监视RMON和面向交换的SMON, 以及网络配置管理。

教学重点和难点：

重点掌握SNMP的原理和功能。

教学内容：

一、SNMP原理

二、SNMPv1

三、SNMPv2

四、SNMPv3

五、RMON和SMON

六、网络配置管理

四、SNMPv3

SNMPv3体系结构

在SNMPv3的架构中, 采用了实体, 标识符和管理信息三种基本概念.

管理者和代理统称为SNMP实体(SNMP Entity). 每个SNMP实体包括一个SNMP引擎和多个相关应用程序.

RFC3411 An Architecture for Describing Simple Network Management Protocol (SNMP) Management Frameworks

This document describes an architecture for describing Simple Network
Management Protocol (SNMP) Management Frameworks. The architecture
is designed to be modular to allow the evolution of the SNMP protocol
standards over time. The major portions of the architecture are an
SNMP engine containing a Message Processing Subsystem, a Security
Subsystem and an Access Control Subsystem, and possibly multiple SNMP
applications which provide specific functional processing of
management data.

3.  Elements of the Architecture
   This section describes the various elements of the architecture and
   how they are named.  There are three kinds of naming:
      1) the naming of entities,
      2) the naming of identities, and
      3) the naming of management information.

SNMP实体及其内部组件

   An SNMP entity is an implementation of this architecture.  Each such
   SNMP entity consists of an SNMP engine and one or more associated
   applications.

   The following figure shows details about an SNMP entity and the
   components within it.

   +-------------------------------------------------------------------+
   |  SNMP entity                                                      |
   |                                                                   |
   |  +-------------------------------------------------------------+  |
   |  |  SNMP engine (identified by snmpEngineID)                   |  |
   |  |                                                             |  |
   |  |  +------------+ +------------+ +-----------+ +-----------+  |  |
   |  |  |            | |            | |           | |           |  |  |
   |  |  | Dispatcher | | Message    | | Security  | | Access    |  |  |
   |  |  |            | | Processing | | Subsystem | | Control   |  |  |
   |  |  |            | | Subsystem  | |           | | Subsystem |  |  |
   |  |  |            | |            | |           | |           |  |  |
   |  |  +------------+ +------------+ +-----------+ +-----------+  |  |
   |  |                                                             |  |
   |  +-------------------------------------------------------------+  |
   |                                                                   |
   |  +-------------------------------------------------------------+  |
   |  |  Application(s)                                             |  |
   |  |                                                             |  |
   |  |  +-------------+  +--------------+  +--------------+        |  |
   |  |  | Command     |  | Notification |  | Proxy        |        |  |
   |  |  | Generator   |  | Receiver     |  | Forwarder    |        |  |
   |  |  +-------------+  +--------------+  +--------------+        |  |
   |  |                                                             |  |
   |  |  +-------------+  +--------------+  +--------------+        |  |
   |  |  | Command     |  | Notification |  | Other        |        |  |
   |  |  | Responder   |  | Originator   |  |              |        |  |
   |  |  +-------------+  +--------------+  +--------------+        |  |
   |  |                                                             |  |
   |  +-------------------------------------------------------------+  |
   |                                                                   |
   +-------------------------------------------------------------------+

SNMP引擎

SNMP引擎的功能

SNMP引擎提供下列服务

• 发送和接收报文
• 认证和加密报文
• 控制对管理对象的访问

SNMP引擎的组成

1. 调度器(Dispatcher)

   一个SNMP引擎只有一个调度器. 它可以并发地处理多个版本的SNMP报文. 调度器的功能包括以下内容

   • 向/从网络中发送/接收SNMP报文
   • 确定SNMP报文的版本, 并交给相应的报文处理模块处理
   • 为接收PDU的SNMP应用提供一个抽象的接口
   • 为发送PDU的SNMP 应用提供一个抽象的接口

   3.1.1.2.  Dispatcher
   
      There is only one Dispatcher in an SNMP engine.  It allows for
      concurrent support of multiple versions of SNMP messages in the SNMP
      engine.  It does so by:
   
         -  sending and receiving SNMP messages to/from the network,
   
         -  determining the version of an SNMP message and interacting with
            the corresponding Message Processing Model,
   
         -  providing an abstract interface to SNMP applications for
            delivery of a PDU to an application.
   
         -  providing an abstract interface for SNMP applications that
            allows them to send a PDU to a remote SNMP entity.
   

2. 报文处理子系统(Message Processing Subsystem)

   报文处理子系统由一个或多个报文处理模块组成. 每一个报文处理模块定义了一种特殊的SNMP报文格式. 它的功能是按照预定的格式准备要发送的报文, 或者从接收的报文中提取数据. 这种体系结构允许扩充其他的报文处理模块. 扩充的处理模块可以是企业专用的, 也可以是以后的标准增添的. 每一个报文处理模块都定义了一种特殊的SNMP 报文格式, 以便能够按照这种格式生成报文或从报文中提取数据.

      +------------------------------------------------------------------+
      |                                                                  |
      |  Message Processing Subsystem                                    |
      |                                                                  |
      |  +------------&#