Address Filtering for SNMPv3 Users

CA SystemEDGE User Guide › Agent Configuration › SNMPv3 Configuration › Configure SNMPv3 User Information › Address Filtering for SNMPv3 Users

Address Filtering for SNMPv3 Users

The SNMPv3 configuration file lets you specify a source address filter to restrict access to the information only to those source addresses that match the address filter.

Following are supported syntax and usage guidelines for the address filtering field:

Full IPv4 addresses are supported.
Example:
```
130.10.100.101
```
This line specifies that the requests from the source address 130.10.100.101 are allowed access to the agent.
Full IPv6 addresses are supported. Specify hexadecimal notation for IPv6 addresses. You can specify characters in lowercase or uppercase. Following is an example IPv6 address:
```
Ea2f:fe90:abcd:0000:230:a2f:200:ad01
```
This line specifies that the requests from the source address ea2f:fe90:abcd:0000:230:a2f:200:ad01 are allowed access to the agent.
Host names are supported. However, we highly recommend using IP addresses as filters instead of host names, because a server might have multiple IP addresses associated with it, and not all of the IP addresses might be associated with the host name in the DNS.
Example:
```
box1.domain.com
```
This line specifies that the requests from box1.domain.com are allowed access to the agent.

Note: If you specify a host name, the agent must be able to resolve the IP address received to the specified source host name.
Wild card character asterisks (*) are supported. Use wild card characters to specify a range of addresses that can access the agent.
Example:
```
130.10.*.101
```
This line specifies that the requests from the source IPv4 addresses starting from 130.10 and ending with 101 (i.e. 130.10.0.101 to 130.10.255.101) are allowed access to the agent.

Example:
```
Ea2f:fe90:*:ad01
```
This line specifies that the requests from the source IPv6 addresses starting with ea2f:fe90 and ending with ad01 are allowed access to the agent.
If you specify wild card character (*), it should be the only character in that IP field. IP fields are the characters between dot “.” (for IPv4 addresses) and colon “:” (for IPv6 addresses).
For example, an entry of 130.10.3*.200 is invalid because the 3 cannot be within the same dot as the asterisk. An entry of Ea2f:fe*:abcd:0000:230:a2f:200:ad01 is also invalid because the 'fe' cannot be within the same colon as the asterisk.
In the case of multiple wild cards, only the leftmost wild card is stretched to fill the missing fields. For example, entering 2002:*:12f4:*:1012 is the same as entering 2002:*:*:*:*:12f4:*:1012.
0 (zero) is treated as a wild card character.
Example:
```
130.10.120.0
```
This line specifies that the requests from the IPv4 subnet 130.10.120 are allowed access to the agent. Entering the address this way is the same as specifying 130.10.120.*.

Example:
```
Ea2f:fe90:0:ad01
```
This line specifies that the request from IPv6 addresses starting with ea2f:fe90 and ending with ad01 are allowed access to the agent. This is the same as entering Ea2f:fe90:*:ad01.
Use two or more zeros to remove the wild card behavior of a single zero and to treat it as a literal zero.
Example:
```
130.000.120.00
```
This line specifies that the requests from the IPv4 address 130.0.120.0 are allowed access to the agent.

Example:
```
Ea2f:*:0000:000:ad01
```
This line specifies that requests from the IPv6 addresses starting with ea2f and ending with 0:0:ad01 are allowed access to the agent.
Partial IP addresses are supported. Partial addresses are treated as partial addresses followed by a wild card (*). Any requests coming from the source address starting with the partial address are allowed.
For example, 130.10 would be same as specifying 130.10.*. Also, Ea2f:fe90 would be same as specifying Ea2f:fe90:*.
For IPv6 addresses, two consecutive colons (::) are treated as a wildcard between two colons (:*:).
A range of addresses using a dash (-) is supported for IPv4 and IPv6 addresses. Any or all the fields can have the range defined.
Examples:
```
130.10-255.100.101
```
This line specifies that the requests from the source IPv4 address range from 130.10 to 130.255 are allowed access to the agent
```
e000-efff:f0ff:bef0:*
```
This line specifies that the requests from the source IPv6 address range from e000:* to efff:* are allowed access to the agent.

Multiple filters delimited by a comma (,) are supported.

Example:

130.10-255.100.101, e000-efff:f0ff:bef0:*, 130.10.120.0, box2.domain.com

No spaces are allowed.

Note: When a host has multiple interfaces or IP addresses, you must supply all its interfaces and IP addresses to access the agent, because the request (such as snmpget, walktree, snmpset, etc) could be sent through any of the interfaces or IP addresses. You must define all IP addresses assigned to the host in the agent's IP filter, or the host does not have access to the agent. As an alternative to defining all IP addresses and interfaces, you can specify the host name, as long as you are aware of the limitations of using host names.