1

When I configure SNMP on IOS I use this syntax:

snmp-server group [group] v3 priv
snmp-server user [user] [group] v3 auth sha [blah] priv aes 128 [blah] access [ACL]

ip access-list standard [ACL]
 permit 192.168.1.1

I've tried to configure the same on a Nexus device. I notice there is no 'snmp-server group' command but I can specify a group after when adding a user.

I'm a bit confused on the differences between the two OS's.

The syntax to add SNMP user on NX-OS:

snmp-server user [user] auth sha [blah] priv aes-128 [blah]

One thing different here is I can't specify an access-list associated with a group. Why is that? Thanks.

  • What version of nx-os do you use?<br/> Nx-os 6.1 does not support access list for SNMPv3.<br/> A few of 6.x version still have limitation.<br/> – Roger Sanghee Gold Dec 6 '16 at 1:05
  • 6.2(14) on 7K and 7.0(3) on 9K – SwitchArt Dec 6 '16 at 1:14
2

The ACL does work but is handled in a second line - so:

snmp-server user [user] auth ...

(as above)

and then

snmp user [user] {use-ipv4acl | use-ipv6acl} [aclname]

This syntax can also be used with a standard v1/v2/v2c community. The above should be fine for 6.2 on the 7K and any 7.0(3) iteration on the 9K.

I'm not sure how to answer your other question - as you write, the group is now configured on the same line as the v3 user and so forth.

EDIT: For reference - Nexus 7000 / NXOS 6.2 System Configuration Guide.

| improve this answer | |
  • Thanks for the reply! To clarify: in IOS there is a line to specify a group. There is no such line in NX-OS. BUT you are able to specify a group after you enter the username: # snmp-server user [user] [group] auth... this confuses me. :/ But the line to handle the ACL makes sense, and this maybe all I need. I'll test directly and respond. – SwitchArt Dec 6 '16 at 3:22
  • 1
    The group actually corresponds to the NXOS role listing. You'd specify the access and behaviors of the group as part of a role (one of the pre-defined ones or roll your own) and then tie it to the user ID as part of that command line. IOS has no notion of privilege apart from levels 1-15. NXOS includes both those as well as some new ones (san-admin, vdc-admin, etc) and the ability to roll your own without having to define things hierarchically. – rnxrx Dec 6 '16 at 3:52
  • So I tested and inputted the config without issue. I had success with the 9K communicating but the 7K and ASA no such luck. I'll keep on looking into why. – SwitchArt Dec 7 '16 at 5:37
  • To followup here. A context attached to the ASA required an ACL to allow SNMP. The 7K just needed to have it source interface used (I was using the MGMT IP) The above config is sound. – SwitchArt Dec 12 '16 at 4:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.