2

How do you setup SNMP on different Cisco switches or routers?

Is it possible to limit the IP addresses/subnets, that can access the SNMP communities via access lists?

How do you recover or configure a switch using SNMP? For instance, you've accidentally made a configuration change and saved it, where shortly after you've lost CLI access. But the device is still obtainable via SNMP.

What can you do to get CLI access back?

3

Introduction

The following configurations have been tested and in order for a management system to poll the switch, you will need to have setup basics like a management interface/IP address and, in some cases, VRF management - depending on your network design etc.

Tested on layer 2/3 switches like: 2960S/X Series, 3560 Series, 3650 Series, 3850 Series, 9200 Series, 9300 Series and 9500 Series etc.

SNMPv2c

I would strongly recommend using SNMPv3 if possible. SNMPv2c offers no encryption or authorization. If you know the read/write community, you can control the device.

Community-based Simple Network Management Protocol Version 2 (SNMPv2c) is an experimental Internet protocol defined in RFC 1901, RFC 1905, and RFC 1906. SNMPv2c is the community string-based administrative framework for SNMPv2. Community string is a type of password, which is transmitted in cleartext. SNMPv2c is an update of the protocol operations and data types of party-based Simple Network Management Protocol Version 2 (SNMPv2p) and uses the community-based security model of SNMPv1.

Security Features in SNMPv2c

Community-based Simple Network Management Protocol Version 2 (SNMPv2c) uses a community-based form of security. The community of SNMP managers that are able to access the agent MIB is defined by an IP address access control list (ACL) and password.

The improved error handling support provided by SNMPv2c includes expanded error codes that distinguish different types of errors; all types of errors are reported through a single error code in SNMPv1. The following three types of exceptions are also reported: no such object, no such instance, and end of MIB view. The following are the details of SNMv2c security model:

  • Level of security: noAuthNoPriv
  • Authentication method: Community String
  • Availability of encryption: No

Depending on your release, the party-based SNMP Version 2 (SNMPv2p), which is another variant of SNMPv2, is not supported. SNMPv2c replaces the party-based administrative and security framework of SNMPv2p with a community-based administrative framework. SNMPv2c retains the bulk retrieval and error handling capabilities of SNMPv2p.

Configuration

First we setup an access-list, that will list the network(s) or specific hosts we allow to access the switch via SNMP:

ip access-list standard snmp_acl
 permit <network> 0.0.0.255 
 permit <host> 0.0.0.0
 deny any log ! log any other attempt to access the switch via SNMP

Now we create the SNMP configuration:

SNMPv2c View Communities (To give access to the full SNMP tree of the device)

snmp-server view community_read iso included
snmp-server view community_read_write iso included

SNMPv2c Communities

snmp-server community thEb0EjiRO view community_read RO snmp_acl
snmp-server community wROb7ChiRW view community_read_write RW snmp_acl (also used for IPSLA)

Please always use password like communities to create a form of security.

That's it. You will now be able to run a SNMPwalk on your switch via the management or SVI interface of your choosing.

SNMPv3

The SNMP Version 3 feature provides secure access to devices by authenticating and encrypting data packets over the network. Simple Network Management Protocol version 3 (SNMPv3) is an interoperable, standards-based protocol that is defined in RFCs 3413 to 3415.

The security features provided in SNMPv3 are as follows:

  • Message integrity—Ensures that a packet has not been tampered with during transit.
  • Authentication—Determines that the message is from a valid source.
  • Encryption—Scrambles the content of a packet to prevent it from being learned by an unauthorized source.

SNMPv3 is a security model in which an authentication strategy is set up for a user and the group in which the user resides. Security level is the permitted level of security within a security model. A combination of a security model and a security level determines which security mechanism is used when handling an SNMP packet.

Configuration

First we setup an access-list, that will list the network(s) or specific hosts we allow to access the switch via SNMP:

ip access-list standard snmp_acl
 permit <network> 0.0.0.255 
 permit <host> 0.0.0.0
 deny any log ! log any other attempt to access the switch via SNMP

Now we create the SNMP configuration:

SNMPv3 Group

snmp-server group your_group_name v3 auth read community_read write community_read_write access snmp_acl

SNMPv3 View Communities (To give access to the full SNMP tree of the device)

snmp-server view community_read iso included
snmp-server view community_read_write iso included

SNMPv3 User

snmp-server user your_user your_group_name v3 auth md5 md5_password priv aes 128 aes_password access snmp_acl

That's it. You will now be able to run a SNMPwalk on your switch via the management or SVI interface of your choosing.

2

How to upload a new configuration via SNMP

In the following section I will show how you can configure or upload configurations using SNMP. It's important to know, that you will have to setup a FTP server before hand and have the CLI configuration ready in a text file on the server.

In the following example i'm using Ubuntu, but the SNMP OID's can be used by any SNMP setting software, that you prefer.

I'm assuming that the device is using SNMP version 3, as explained above, this is the recommended way to set it up. I'll be using the above passwords in the example.

  • Let's assume the network device IP address is: 10.0.0.1
  • Let's assume the FTP server IP address is: 10.0.0.2

Since this example concentrates on Cisco devices, the following link will give a complete glance of all Cisco MIB/OID's:

https://mibs.cloudapps.cisco.com/ITDIT/MIBS/servlet/index

SNMPwalk:

This is an SNMP application that uses SNMP GETNEXT requests to query a network entity for a tree of information. An object identifier (OID) may be given on the command line. This OID specifies which portion of the object identifier space will be searched using GETNEXT requests. All variables in the subtree below the given OID are queried and their values presented to the user.

snmpwalk -v 3 -a MD5 -A md5_password -l authPriv -u your_user -x AES -X aes_password [IP] [Optional: OID]

Concrete example using the above IP address:

snmpwalk -v 3 -a MD5 -A md5_password -l authPriv -u your_user -x AES -X aes_password 10.0.0.1

SNMPset:

This is an SNMP application that uses the SNMP SET request to set information on a network entity. One or more object identifiers (OIDs) must be given as arguments on the command line. A type and a value to be set must accompany each object identifier.

The TYPE is a single character, one of:

  • i = INTEGER
  • u = UNSIGNED
  • s = STRING
  • x = HEX STRING
  • d = DECIMAL STRING
  • n = NULLOBJ
  • o = OBJID
  • t = TIMETICKS
  • a = IPADDRESS
  • b = BITS

Example:

snmpset -v 3 -a MD5 -A md5_password -l authPriv -u your_user -x AES -X aes_password [IP] [OID] [TYPE]

Example of how to upload using SNMP

First OID, we set the type of service we want to use (source).

  1. tftp
  2. ftp
  3. rcp
  4. scp
  5. sftp

We want to use FTP, Example:

snmpset -v 3 -a MD5 -A md5_password -l authPriv -u your_user -x AES -X aes_password 10.0.0.1 1.3.6.1.4.1.9.9.96.1.1.1.1.2.336 i 2

Now we set the source file type.

  1. networkFile
  2. iosFile
  3. startupConfig
  4. runningConfig
  5. terminal
  6. fabricStartupConfig

We want to be using a network file, Example:

snmpset -v 3 -a MD5 -A md5_password -l authPriv -u your_user -x AES -X aes_password 10.0.0.1 1.3.6.1.4.1.9.9.96.1.1.1.1.3.336 i 1

We we set the destination, this is where we want to copy to.

  1. networkFile
  2. iosFile
  3. startupConfig
  4. runningConfig
  5. terminal
  6. fabricStartupConfig

We want to be copying to the runningConfig, Example:

snmpset -v 3 -a MD5 -A md5_password -l authPriv -u your_user -x AES -X aes_password 10.0.0.1 1.3.6.1.4.1.9.9.96.1.1.1.1.4.336 i 4

Now we setup the FTP server.

FTP server address:

snmpset -v 3 -a MD5 -A md5_password -l authPriv -u your_user -x AES -X aes_password 10.0.0.1 1.3.6.1.4.1.9.9.96.1.1.1.1.5.336 a 10.0.0.2

Source Filename to copy to the network device:

snmpset -v 3 -a MD5 -A md5_password -l authPriv -u your_user -x AES -X aes_password 10.0.0.1 1.3.6.1.4.1.9.9.96.1.1.1.1.6.336 s config.txt

Username:

snmpset -v 3 -a MD5 -A md5_password -l authPriv -u your_user -x AES -X aes_password 10.0.0.1 1.3.6.1.4.1.9.9.96.1.1.1.1.7.336 s admin

Password:

snmpset -v 3 -a MD5 -A md5_password -l authPriv -u your_user -x AES -X aes_password 10.0.0.1 1.3.6.1.4.1.9.9.96.1.1.1.1.8.336 s Password

All you have to do now is activate the transfer:

snmpset -v 3 -a MD5 -A md5_password -l authPriv -u your_user -x AES -X aes_password 10.0.0.1 1.3.6.1.4.1.9.9.96.1.1.1.1.14.336 i 1

Remember to destroy the session and disconnect, using:

snmpset -v 3 -a MD5 -A md5_password -l authPriv -u your_user -x AES -X aes_password 10.0.0.1 1.3.6.1.4.1.9.9.96.1.1.1.1.14.336 i 6

That's it, you should now have uploaded config.txt to your network device running-config.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy