topic Re: SNMP Support over VPNs—Context Based Access Control in Network Security https://community.cisco.com/t5/network-security/snmp-support-over-vpns-context-based-access-control/m-p/265296#M1060160 <HTML><HEAD></HEAD><BODY><P>Information about this feature including configuration examples is available in the documentation at <A class="jive-link-custom" href="http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/products_feature_guide09186a00801a6d84.html" target="_blank">http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/products_feature_guide09186a00801a6d84.html</A>. I also feel that the image 12.3(7)T is not exactly the best choice. The image is pretty new and a 'T' image. You might end up running into bugs frequently.</P></BODY></HTML> Thu, 18 Mar 2004 16:40:04 GMT drolemc 2004-03-18T16:40:04Z SNMP Support over VPNs—Context Based Access Control https://community.cisco.com/t5/network-security/snmp-support-over-vpns-context-based-access-control/m-p/265295#M1060156 <P>I am a little confused as to what this feature is designed to provide. I've been experimenting with this based on the examples in the CCO documentation.</P><P>Can anyone offer me any insight into the design of this feature?</P><P></P><P>My initial understanding was that all of the MIB data would be available (unless limited by a view) and that the contexts would limit access on a per VRF basis. For example</P><P>VRF Customer_A1 could be in contextA</P><P>VRF Customer_A2 could also be in contextA</P><P>VRF Customer_B could be in contextB.</P><P>When a walk query was performed on the MPLS-VPN MIB then only the data for the VRFs in the relevant context would be shown - so UserA (in GroupA which is associated with contextA) could see data about the Customer_A1 and Customer_A2 VRFs only, and UserB (in GroupB which is associated with contextB) could only see the information in contextB.</P><P></P><P>It seems that my theories weren't quite right - the vrf &lt;-&gt; context &lt;-&gt; group relationship appears to be a little strange. A context must be unique and cannot be duplicated between VRFs - this means that CustomerA that has two (or possibly more) VRFs on a router can't see data on both using the userA login? </P><P></P><P>It also appears that this feature doesn't work with views enabled on 12.3(7)T, and the data provided when context alone is used is limited to a subset of the IP-Forwarding MIB?</P><P></P><P></P> Fri, 21 Feb 2020 07:17:27 GMT https://community.cisco.com/t5/network-security/snmp-support-over-vpns-context-based-access-control/m-p/265295#M1060156 admin_2 2020-02-21T07:17:27Z Re: SNMP Support over VPNs—Context Based Access Control https://community.cisco.com/t5/network-security/snmp-support-over-vpns-context-based-access-control/m-p/265296#M1060160 <HTML><HEAD></HEAD><BODY><P>Information about this feature including configuration examples is available in the documentation at <A class="jive-link-custom" href="http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/products_feature_guide09186a00801a6d84.html" target="_blank">http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/products_feature_guide09186a00801a6d84.html</A>. I also feel that the image 12.3(7)T is not exactly the best choice. The image is pretty new and a 'T' image. You might end up running into bugs frequently.</P></BODY></HTML> Thu, 18 Mar 2004 16:40:04 GMT https://community.cisco.com/t5/network-security/snmp-support-over-vpns-context-based-access-control/m-p/265296#M1060160 drolemc 2004-03-18T16:40:04Z