Configuring SNMP 25846 B Cisco N5k System Mgmt Cg Rel 513 N1 1 Chapter 01110
User Manual: 25846
Open the PDF directly: View PDF 
.
Page Count: 22
| Download | |
| Open PDF In Browser | View PDF |
Configuring SNMP
This chapter contains the following sections:
• Information About SNMP, page 1
• Licensing Requirements for SNMP, page 5
• Guidelines and Limitations for SNMP, page 6
• Default SNMP Settings, page 6
• Configuring SNMP, page 6
• Disabling SNMP, page 20
• Verifying the SNMP Configuration, page 20
• Feature History for SNMP, page 21
Information About SNMP
The Simple Network Management Protocol (SNMP) is an application-layer protocol that provides a message
format for communication between SNMP managers and agents. SNMP provides a standardized framework
and a common language used for the monitoring and management of devices in a network.
SNMP Functional Overview
The SNMP framework consists of three parts:
• An SNMP manager—The system used to control and monitor the activities of network devices using
SNMP.
• An SNMP agent—The software component within the managed device that maintains the data for the
device and reports these data, as needed, to managing systems. The Cisco Nexus device supports the
agent and MIB. To enable the SNMP agent, you must define the relationship between the manager and
the agent.
• A managed information base (MIB)—The collection of managed objects on the SNMP agent
Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)
OL-25846-01
1
Configuring SNMP
SNMP Notifications
Note
Cisco NX-OS does not support SNMP sets for Ethernet MIBs.
The Cisco Nexus device supports SNMPv1, SNMPv2c, and SNMPv3. Both SNMPv1 and SNMPv2c use a
community-based form of security.
Cisco NX-OS supports SNMP over IPv6.
SNMP is defined in RFC 3410 (http://tools.ietf.org/html/rfc3410), RFC 3411 (http://tools.ietf.org/html/rfc3411),
RFC 3412 (http://tools.ietf.org/html/rfc3412), RFC 3413 (http://tools.ietf.org/html/rfc3413), RFC 3414 (http:/
/tools.ietf.org/html/rfc3414), RFC 3415 (http://tools.ietf.org/html/rfc3415), RFC 3416 (http://tools.ietf.org/
html/rfc3416), RFC 3417 (http://tools.ietf.org/html/rfc3417), RFC 3418 (http://tools.ietf.org/html/rfc3418),
and RFC 3584 (http://tools.ietf.org/html/rfc3584).
SNMP Notifications
A key feature of SNMP is the ability to generate notifications from an SNMP agent. These notifications do
not require that requests be sent from the SNMP manager. Notifications can indicate improper user
authentication, restarts, the closing of a connection, loss of connection to a neighbor router, or other significant
events.
Cisco NX-OS generates SNMP notifications as either traps or informs. A trap is an asynchronous,
unacknowledged message sent from the agent to the SNMP managers listed in the host receiver table. Informs
are asynchronous messages sent from the SNMP agent to the SNMP manager which the manager must
acknowledge receipt of.
Traps are less reliable than informs because the SNMP manager does not send any acknowledgment when it
receives a trap. The switch cannot determine if the trap was received. An SNMP manager that receives an
inform request acknowledges the message with an SNMP response protocol data unit (PDU). If the Cisco
Nexus device never receives a response, it can send the inform request again.
You can configure Cisco NX-OS to send notifications to multiple host receivers.
SNMPv3
SNMPv3 provides secure access to devices by a combination of authenticating and encrypting frames over
the network. The security features provided in SNMPv3 are the following:
• Message integrity—Ensures that a packet has not been tampered with in-transit.
• Authentication—Determines the message is from a valid source.
• Encryption—Scrambles the packet contents to prevent it from being seen by unauthorized sources.
SNMPv3 provides for both security models and security levels. A security model is an authentication strategy
that is set up for a user and the role in which the user resides. A security level is the permitted level of security
within a security model. A combination of a security model and a security level determines which security
mechanism is employed when handling an SNMP packet.
Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)
2
OL-25846-01
Configuring SNMP
SNMPv3
Security Models and Levels for SNMPv1, v2, and v3
The security level determines if an SNMP message needs to be protected from disclosure and if the message
needs to be authenticated. The various security levels that exist within a security model are as follows:
• noAuthNoPriv—Security level that does not provide authentication or encryption.
• authNoPriv—Security level that provides authentication but does not provide encryption.
• authPriv—Security level that provides both authentication and encryption.
Three security models are available: SNMPv1, SNMPv2c, and SNMPv3. The security model combined with
the security level determine the security mechanism applied when the SNMP message is processed.
Table 1: SNMP Security Models and Levels
Model
Level
Authentication
Encryption
What Happens
v1
noAuthNoPriv
Community string
No
Uses a community
string match for
authentication.
v2c
noAuthNoPriv
Community string
No
Uses a community
string match for
authentication.
v3
noAuthNoPriv
Username
No
Uses a username
match for
authentication.
v3
authNoPriv
HMAC-MD5 or
HMAC-SHA
No
Provides
authentication based
on the Hash-Based
Message
Authentication Code
(HMAC) Message
Digest 5 (MD5)
algorithm or the
HMAC Secure Hash
Algorithm (SHA).
Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)
OL-25846-01
3
Configuring SNMP
SNMPv3
Model
Level
Authentication
Encryption
What Happens
v3
authPriv
HMAC-MD5 or
HMAC-SHA
DES
Provides
authentication based
on the HMAC-MD5
or HMAC-SHA
algorithms. Provides
Data Encryption
Standard (DES)
56-bit encryption in
addition to
authentication based
on the Cipher Block
Chaning (CBC)
DES (DES-56)
standard.
User-Based Security Model
SNMPv3 User-Based Security Model (USM) refers to SNMP message-level security and offers the following
services:
• Message integrity—Ensures that messages have not been altered or destroyed in an unauthorized manner
and that data sequences have not been altered to an extent greater than can occur nonmaliciously.
• Message origin authentication—Confirms that the claimed identity of the user who received the data
was originated.
• Message confidentiality—Ensures that information is not made available or disclosed to unauthorized
individuals, entities, or processes.
SNMPv3 authorizes management operations only by configured users and encrypts SNMP messages.
Cisco NX-OS uses two authentication protocols for SNMPv3:
• HMAC-MD5-96 authentication protocol
• HMAC-SHA-96 authentication protocol
Cisco NX-OS uses Advanced Encryption Standard (AES) as one of the privacy protocols for SNMPv3 message
encryption and conforms with RFC 3826.
The priv option offers a choice of DES or 128-bit AES encryption for SNMP security encryption. The priv
option and the aes-128 token indicates that this privacy password is for generating a 128-bit AES key #.The
AES priv password can have a minimum of eight characters. If the passphrases are specified in clear text, you
can specify a maximum of 64 characters. If you use the localized key, you can specify a maximum of 130
characters.
Note
For an SNMPv3 operation using the external AAA server, you must use AES for the privacy protocol in
user configuration on the external AAA server.
Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)
4
OL-25846-01
Configuring SNMP
Licensing Requirements for SNMP
CLI and SNMP User Synchronization
SNMPv3 user management can be centralized at the Access Authentication and Accounting (AAA) server
level. This centralized user management allows the SNMP agent in Cisco NX-OS to leverage the user
authentication service of the AAA server. Once user authentication is verified, the SNMP PDUs are processed
further. Additionally, the AAA server is also used to store user group names. SNMP uses the group names to
apply the access/role policy that is locally available in the switch.
Any configuration changes made to the user group, role, or password results in database synchronization for
both SNMP and AAA.
Cisco NX-OS synchronizes user configuration in the following ways:
• The auth passphrase specified in the snmp-server user command becomes the password for the CLI
user.
• The password specified in the username command becomes the auth and priv passphrases for the
SNMP user.
• If you create or delete a user using either SNMP or the CLI, the user is created or deleted for both SNMP
and the CLI.
• User-role mapping changes are synchronized in SNMP and the CLI.
• Role changes (deletions or modifications from the CLI) are synchronized to SNMP.
Note
When you configure passphrase/password in localized key/encrypted format, Cisco NX-OS does not
synchronize the user information (passwords, rules, etc.).
Group-Based SNMP Access
Note
Because a group is a standard SNMP term used industry-wide, roles are referred to as groups in this SNMP
section.
SNMP access rights are organized by groups. Each group in SNMP is similar to a role through the CLI. Each
group is defined with three accesses: read access, write access, and notification access. Each access can be
enabled or disabled within each group.
You can begin communicating with the agent once your username is created, your roles are set up by your
administrator, and you are added to the roles.
Licensing Requirements for SNMP
This feature does not require a license. Any feature not included in a license package is bundled with the Cisco
NX-OS system images and is provided at no extra charge to you. For a complete explanation of the Cisco
NX-OS licensing scheme, see the Cisco NX-OS Licensing Guide.
Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)
OL-25846-01
5
Configuring SNMP
Guidelines and Limitations for SNMP
Guidelines and Limitations for SNMP
Cisco NX-OS supports read-only access to Ethernet MIBs.
For more information about supported MIBs, see the following URL:
http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml
Default SNMP Settings
Table 2: Default SNMP Parameters
Parameters
Default
license notifications
Enabled
linkUp/Down notification type
ietf-extended
Configuring SNMP
Configuring SNMP Users
Note
The commands used to configure SNMP users in Cisco NX-OS are different from those used to configure
users in Cisco IOS.
SUMMARY STEPS
1. configure terminal
2. switch(config)# snmp-server user name [auth {md5 | sha} passphrase [auto] [priv [aes-128] passphrase]
[engineID id] [localizedkey]]
3. (Optional) switch# show snmp user
4. (Optional) copy running-config startup-config
Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)
6
OL-25846-01
Configuring SNMP
Enforcing SNMP Message Encryption
DETAILED STEPS
Step 1
Command or Action
Purpose
configure terminal
Enters global configuration mode.
Example:
switch# configure terminal
switch(config)#
Step 2
switch(config)# snmp-server user name [auth {md5 Configures an SNMP user with authentication and privacy
| sha} passphrase [auto] [priv [aes-128] passphrase] parameters.
[engineID id] [localizedkey]]
The passphrase can be any case-sensitive, alphanumeric string
up to 64 characters.
Example:
switch(config)# snmp-server user Admin auth
sha abcd1234 priv abcdefgh
If you use the localizedkey keyword, the passphrase can be any
case-sensitive, alphanumeric string up to 130 characters.
The engineID format is a 12-digit, colon-separated decimal
number.
Step 3
switch# show snmp user
(Optional)
Displays information about one or more SNMP users.
Example:
switch(config) # show snmp user
Step 4
copy running-config startup-config
Example:
(Optional)
Saves the change persistently through reboots and restarts by
copying the running configuration to the startup configuration.
switch(config)# copy running-config
startup-config
The following example shows how to configure an SNMP user:
switch# config t
Enter configuration commands, one per line. End with CNTL/Z.
switch(config)# snmp-server user Admin auth sha abcd1234 priv abcdefgh
Enforcing SNMP Message Encryption
You can configure SNMP to require authentication or encryption for incoming requests. By default, the SNMP
agent accepts SNMPv3 messages without authentication and encryption. When you enforce privacy, Cisco
NX-OS responds with an authorization error for any SNMPv3 PDU request that uses a security level parameter
of either noAuthNoPriv or authNoPriv.
Use the following command in global configuration mode to enforce SNMP message encryption for a specific
user:
Command
Purpose
switch(config)# snmp-server user name enforcePriv Enforces SNMP message encryption for this user.
Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)
OL-25846-01
7
Configuring SNMP
Assigning SNMPv3 Users to Multiple Roles
Use the following command in global configuration mode to enforce SNMP message encryption for all users:
Command
Purpose
switch(config)# snmp-server globalEnforcePriv
Enforces SNMP message encryption for all users.
Assigning SNMPv3 Users to Multiple Roles
After you configure an SNMP user, you can assign multiple roles for the user.
Note
Only users who belong to a network-admin role can assign roles to other users.
Command
Purpose
switch(config)# snmp-server user name group
Associates this SNMP user with the configured user
role.
Creating SNMP Communities
You can create SNMP communities for SNMPv1 or SNMPv2c.
Command
Purpose
switch(config)# snmp-server community name
group {ro | rw}
Creates an SNMP community string.
Filtering SNMP Requests
You can assign an access list (ACL) to a community to filter incoming SNMP requests. If the assigned ACL
allows the incoming request packet, SNMP processes the request. If the ACL denies the request, SNMP drops
the request and sends a system message.
Create the ACL with the following parameters:
• Source IP address
• Destination IP address
• Source port
• Destination port
• Protocol (UDP or TCP)
The ACL applies to both IPv4 and IPv6 over UDP and TCP. After creating the ACL, assign the ACL to the
SNMP community.
Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)
8
OL-25846-01
Configuring SNMP
Configuring SNMP Notification Receivers
Tip
For more information about creating ACLs, see the NX-OS security configuration guide for the Cisco
Nexus Series software that you are using.
Use the following command in global configuration mode to assign an ACL to a community to filter SNMP
requests:
Command
Purpose
switch(config)# snmp-server community community Assigns an ACL to an SNMP community to filter
SNMP requests.
name use-acl acl-name
Example:
switch(config)# snmp-server community public
use-acl my_acl_for_public
Configuring SNMP Notification Receivers
You can configure Cisco NX-OS to generate SNMP notifications to multiple host receivers.
You can configure a host receiver for SNMPv1 traps in a global configuration mode.
Command
Purpose
switch(config)# snmp-server host ip-address traps Configures a host receiver for SNMPv1 traps. The
ip-address can be an IPv4 or IPv6 address. The
version 1 community [udp_port number]
community can be any alphanumeric string up to 255
characters. The UDP port number range is from 0 to
65535.
You can configure a host receiver for SNMPv2c traps or informs in a global configuration mode.
Command
Purpose
switch(config)# snmp-server host ip-address {traps Configures a host receiver for SNMPv2c traps or
| informs} version 2c community [udp_port number] informs. The ip-address can be an IPv4 or IPv6
address. The community can be any alphanumeric
string up to 255 characters. The UDP port number
range is from 0 to 65535.
You can configure a host receiver for SNMPv3 traps or informs in a global configuration mode.
Command
Purpose
switch(config)# snmp-server host ip-address {traps Configures a host receiver for SNMPv2c traps or
| informs} version 3 {auth | noauth | priv} username informs. The ip-address can be an IPv4 or IPv6
address. The username can be any alphanumeric string
[udp_port number]
up to 255 characters. The UDP port number range is
from 0 to 65535.
Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)
OL-25846-01
9
Configuring SNMP
Configuring SNMP Notification Receivers with VRFs
Note
The SNMP manager must know the user credentials (authKey/PrivKey) based on the SNMP engineID of
the Cisco Nexus device to authenticate and decrypt the SNMPv3 messages.
The following example shows how to configure a host receiver for an SNMPv1 trap:
switch(config)# snmp-server host 192.0.2.1 traps version 1 public
The following example shows how to configure a host receiver for an SNMPv2 inform:
switch(config)# snmp-server host 192.0.2.1 informs version 2c public
The following example shows how to configure a host receiver for an SNMPv3 inform:
switch(config)# snmp-server host 192.0.2.1 informs version 3 auth NMS
Configuring SNMP Notification Receivers with VRFs
You can configure Cisco NX-OS to use a configured VRF to reach the host receiver. SNMP adds entries into
the cExtSnmpTargetVrfTable of the CISCO-SNMP-TARGET-EXT-MIB when you configure the VRF
reachability and filtering options for an SNMP notification receiver.
Note
You must configure the host before configuring the VRF reachability or filtering options.
SUMMARY STEPS
1. switch# configure terminal
2. switch# snmp-server host ip-address use-vrf vrf_name [udp_port number]
3. (Optional) switch(config)# copy running-config startup-config
DETAILED STEPS
Command or Action
Purpose
Step 1
switch# configure terminal
Enters global configuration mode.
Step 2
switch# snmp-server host ip-address
use-vrf vrf_name [udp_port number]
Configures SNMP to use the selected VRF to communicate with the host
receiver. The IP address can be an IPv4 or IPv6 address. The VRF name
can be any alphanumeric string up to 255 characters. The UDP port number
range is from 0 to 65535. This command adds an entry into thc
ExtSnmpTargetVrfTable of the CISCO-SNMP-TARGET-EXT-MB.
Step 3
switch(config)# copy running-config
startup-config
(Optional)
Saves the change persistently through reboots and restarts by copying the
running configuration to the startup configuration.
Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)
10
OL-25846-01
Configuring SNMP
Filtering SNMP Notifications Based on a VRF
The following example shows how to configure the SNMP server host with IP address 192.0.2.1 to use the
VRF named "Blue:"
switch# configuration terminal
switch(config)# snmp-server host 192.0.2.1 use-vrf Blue
switch(config)# copy running-config startup-config
Filtering SNMP Notifications Based on a VRF
You can configure Cisco NX-OS filter notifications based on the VRF in which the notification occurred.
SUMMARY STEPS
1. switch# configure terminal
2. switch(config)# snmp-server host ip-address filter-vrf vrf_name [udp_port number]
3. (Optional) switch(config)# copy running-config startup-config
DETAILED STEPS
Command or Action
Purpose
Step 1
switch# configure terminal
Enters global configuration mode.
Step 2
switch(config)# snmp-server host
Filters notifications to the notification host receiver based on the configured
ip-address filter-vrf vrf_name [udp_port VRF. The IP address can be an IPv4 or IPv6 address. The VRF name can
be any alphanumeric string up to 255 characters. The UDP port number
number]
range is from 0 to 65535.
This command adds an entry into thc ExtSnmpTargetVrfTable of the
CISCO-SNMP-TARGET-EXT-MB.
Step 3
switch(config)# copy running-config
startup-config
(Optional)
Saves the change persistently through reboots and restarts by copying the
running configuration to the startup configuration.
The following example shows how to configure filtering of SNMP notifications based on a VRF:
switch# configuration terminal
switch(config)# snmp-server host 192.0.2.1 filter-vrf Red
switch(config)# copy running-config startup-config
Configuring a Source Interface for Sending Out All SNMP Notifications
You can configure SNMP to use the IP address of an interface as the source IP address for notifications. When
a notification is generated, its source IP address is based on the IP address of this configured interface.
Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)
OL-25846-01
11
Configuring SNMP
Configuring a Host Receiver for SNMP Notifications
Note
Configuring the source interface IP address for outgoing trap packets does not guarantee that the device
will use the same interface to send the trap. The source interface IP address defines the source address
inside of the SNMP trap and the connection is opened with the address of the egress interface as source.
Complete the following steps to configure a source interface for sending out all SNMP notifications:
SUMMARY STEPS
1. configure terminal
2. switch(config) # snmp-server source-interface {traps | informs} if-type if-number
DETAILED STEPS
Step 1
Command or Action
Purpose
configure terminal
Enters global configuration mode.
Example:
switch# configure terminal
switch(config)#
Step 2
switch(config) # snmp-server source-interface {traps |
informs} if-type if-number
Configures a source interface for sending out
SNMPv2c traps or informs. Use ? to determine the
supported interface types.
Example:
switch(config) # snmp-server
source-interface traps ethernet 2/1
This example shows how to configure a source interface to sending out SNMPv2c traps:
switch# configure terminal
switch(config) # snmp-server source-interface traps ethernet 2/1
What to Do Next
To display information about configured source interfaces, enter the show snmp source-interface command.
Configuring a Host Receiver for SNMP Notifications
Note
This configuration overrides the global source interface configuration.
Complete the following steps to configure a host receiver on a source interface responsible for receiving all
SNMP notifications:
Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)
12
OL-25846-01
Configuring SNMP
Configuring SNMP for Inband Access
SUMMARY STEPS
1. configure terminal
2. switch(config) # snmp-server host ip-address source-interface if-type if-number [udp_port number]
DETAILED STEPS
Step 1
Command or Action
Purpose
configure terminal
Enters global configuration mode.
Example:
switch# configure terminal
switch(config)#
Step 2
switch(config) # snmp-server host ip-address source-interface Configures a host receiver for SNMPv2c traps or
informs. The ip-address can be an IPv4 or IPv6 address.
if-type if-number [udp_port number]
Use ? to determine the supported interface types.
Example:
switch(config) # snmp-server host 192.0.2.1
source-interface traps ethernet 2/1
To the following example configures a source interface responsible for receiving all SNMP notifications:
switch# config t
switch(config) # snmp-server host 192.0.2.1 source-interface ethernet 2/1
What to Do Next
To display information about configured source interface, enter the show snmp source-interface command.
Configuring SNMP for Inband Access
You can configure SNMP for inband access using the following:
• Using SNMP v2 without context—You can use a community that is mapped to a context. In this case,
the SNMP client does not need to know about the context.
• Using SNMP v2 with context—The SNMP client needs to specify the context by specifying a community;
for example, @.
• Using SNMP v3—You can specify the context.
SUMMARY STEPS
1. switch# configuration terminal
2. switch(config)# snmp-server context context-name vrf vrf-name
3. switch(config)# snmp-server community community-name group group-name
4. switch(config)# snmp-server mib community-map community-name context context-name
Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)
OL-25846-01
13
Configuring SNMP
Enabling SNMP Notifications
DETAILED STEPS
Command or Action
Purpose
Step 1
switch# configuration terminal
Enters global configuration mode.
Step 2
switch(config)# snmp-server context
context-name vrf vrf-name
Maps an SNMP context to the management VRF or default VRF.
Custom VRFs are not supported.
The names can be any alphanumeric string up to 32 characters.
Step 3
switch(config)# snmp-server community
community-name group group-name
Maps an SNMPv2c community to an SNMP context and identifies
the group to which the community belongs. The names can be any
alphanumeric string up to 32 characters.
Step 4
switch(config)# snmp-server mib
community-map community-name context
context-name
Maps an SNMPv2c community to an SNMP context. The names
can be any alphanumeric string up to 32 characters.
The following SNMPv2 example shows how to map a community named snmpdefault to a context:
switch# config t
Enter configuration commands, one per line. End with CNTL/Z.
switch(config)# snmp-server context def vrf default
switch(config)# snmp-server community snmpdefault group network-admin
switch(config)# snmp-server mib community-map snmpdefault context def
switch(config)#
The following SNMPv2 example shows how to configure and inband access to the community comm which
is not mapped:
switch# config t
Enter configuration commands, one per line. End with CNTL/Z.
switch(config)# snmp-server context def vrf default
switch(config)# snmp-server community comm group network-admin
switch(config)#
The following SNMPv3 example shows how to use a v3 username and password:
switch# config t
Enter configuration commands, one per line. End with CNTL/Z.
switch(config)# snmp-server context def vrf default
switch(config)#
Enabling SNMP Notifications
You can enable or disable notifications. If you do not specify a notification name, Cisco NX-OS enables all
notifications.
Note
The snmp-server enable traps CLI command enables both traps and informs, depending on the configured
notification host receivers.
The following table lists the CLI commands that enable the notifications for Cisco NX-OS MIBs.
Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)
14
OL-25846-01
Configuring SNMP
Enabling SNMP Notifications
Table 3: Enabling SNMP Notifications
MIB
Related Commands
All notifications
snmp-server enable traps
BRIDGE-MIB
snmp-server enable traps bridge newroot
snmp-server enable traps bridge topologychange
CISCO-AAA-SERVER-MIB
snmp-server enable traps aaa
ENITY-MIB,
CISCO-ENTITY-FRU-CONTROL-MIB,
CISCO-ENTITY-SENSOR-MIB
snmp-server enable traps entity
CISCO-LICENSE-MGR-MIB
snmp-server enable traps license
IF-MIB
snmp-server enable traps link
CISCO-PSM-MIB
snmp-server enable traps port-security
SNMPv2-MIB
snmp-server enable traps snmp
snmp-server enable traps entity fru
snmp-server enable traps snmp authentication
CISCO-FCC-MIB
snmp-server enable traps fcc
CISCO-DM-MIB
snmp-server enable traps fcdomain
CISCO-NS-MIB
snmp-server enable traps fcns
CISCO-FCS-MIB
snmp-server enable traps fcs discovery-complete
snmp-server enable traps fcs request-reject
CISCO-FDMI-MIB
snmp-server enable traps fdmi
CISCO-FSPF-MIB
snmp-server enable traps fspf
CISCO-PSM-MIB
snmp-server enable traps port-security
CISCO-RSCN-MIB
snmp-server enable traps rscn
snmp-server enable traps rscn els
snmp-server enable traps rscn ils
Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)
OL-25846-01
15
Configuring SNMP
Configuring Link Notifications
MIB
Related Commands
CISCO-ZS-MIB
snmp-server enable traps zone
snmp-server enable traps zone
default-zone-behavior-change
snmp-server enable traps zone
enhanced-zone-db-change
snmp-server enable traps zone merge-failure
snmp-server enable traps zone merge-success
snmp-server enable traps zone request-reject
snmp-server enable traps zone unsupp-mem
CISCO-CONFIG-MAN-MIB
Note
Note
snmp-server enable traps config
Supports no MIB objects except the
following notification:
ccmCLIRunningConfigChanged
The license notifications are enabled by default.
To enable the specified notification in the global configuration mode, perform one of the following tasks:
Command
Purpose
switch(config)# snmp-server enable traps
Enables all SNMP notifications.
switch(config)# snmp-server enable traps aaa
[server-state-change]
Enables the AAA SNMP notifications.
switch(config)# snmp-server enable traps entity
[fru]
Enables the ENTITY-MIB SNMP notifications.
switch(config)# snmp-server enable traps license
Enables the license SNMP notification.
switch(config)# snmp-server enable traps
port-security
Enables the port security SNMP notifications.
switch(config)# snmp-server enable traps snmp
[authentication]
Enables the SNMP agent notifications.
Configuring Link Notifications
You can configure which linkUp/linkDown notifications to enable on a device. You can enable the following
types of linkUp/linkDown notifications:
• cieLinkDown—Enables the Cisco extended link state down notification.
Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)
16
OL-25846-01
Configuring SNMP
Disabling Link Notifications on an Interface
• cieLinkUp—Enables the Cisco extended link state up notification.
• cisco-xcvr-mon-status-chg—Enables the Cisco interface transceiver monitor status change notification.
• delayed-link-state-change—Enables the delayed link state change.
• extended-linkUp—Enables the Internet Engineering Task Force (IETF) extended link state up notification.
• extended-linkDown—Enables the IETF extended link state down notification.
• linkDown—Enables the IETF Link state down notification.
• linkUp—Enables the IETF Link state up notification.
SUMMARY STEPS
1. configure terminal
2. snmp-server enable traps link [cieLinkDown | cieLinkUp | cisco-xcvr-mon-status-chg |
delayed-link-state-change] | extended-linkUp | extended-linkDown | linkDown | linkUp]
DETAILED STEPS
Step 1
Command or Action
Purpose
configure terminal
Enters global configuration mode.
Example:
switch# configure terminal
switch(config)#
Step 2
snmp-server enable traps link [cieLinkDown | cieLinkUp |
Enables the link SNMP notifications.
cisco-xcvr-mon-status-chg | delayed-link-state-change] | extended-linkUp
| extended-linkDown | linkDown | linkUp]
Example:
switch(config)# snmp-server enable traps link cieLinkDown
Disabling Link Notifications on an Interface
You can disable linkUp and linkDown notifications on an individual interface. You can use these limit
notifications on a flapping interface (an interface that transitions between up and down repeatedly).
SUMMARY STEPS
1. switch# configure terminal
2. switch(config)# interface type slot/port
3. switch(config -if)# no snmp trap link-status
Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)
OL-25846-01
17
Configuring SNMP
Enabling One-Time Authentication for SNMP over TCP
DETAILED STEPS
Command or Action
Purpose
Step 1
switch# configure terminal
Enters global configuration mode.
Step 2
switch(config)# interface type slot/port
Specifies the interface to be changed.
Step 3
switch(config -if)# no snmp trap link-status
Disables SNMP link-state traps for the interface. This
feature is enabled by default.
Enabling One-Time Authentication for SNMP over TCP
You can enable a one-time authentication for SNMP over a TCP session.
Command
Purpose
switch(config)# snmp-server tcp-session [auth]
Enables a one-time authentication for SNMP over a
TCP session. This feature is disabled by default.
Assigning SNMP Switch Contact and Location Information
You can assign the switch contact information, which is limited to 32 characters (without spaces), and the
switch location.
SUMMARY STEPS
1. switch# configuration terminal
2. switch(config)# snmp-server contact name
3. switch(config)# snmp-server location name
4. (Optional) switch# show snmp
5. (Optional) switch# copy running-config startup-config
DETAILED STEPS
Command or Action
Purpose
Step 1
switch# configuration terminal
Enters global configuration mode.
Step 2
switch(config)# snmp-server contact name
Configures sysContact, the SNMP contact name.
Step 3
switch(config)# snmp-server location name
Configures sysLocation, the SNMP location.
Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)
18
OL-25846-01
Configuring SNMP
Configuring the Context to Network Entity Mapping
Command or Action
Purpose
Step 4
switch# show snmp
(Optional)
Displays information about one or more destination
profiles.
Step 5
switch# copy running-config startup-config
(Optional)
Saves this configuration change.
Configuring the Context to Network Entity Mapping
You can configure an SNMP context to map to a logical network entity, such as a protocol instance or VRF.
SUMMARY STEPS
1. switch# configuration terminal
2. switch(config)# snmp-server context context-name [instance instance-name] [vrf vrf-name] [topology
topology-name]
3. switch(config)# snmp-server mib community-map community-name context context-name
4. (Optional) switch(config)# no snmp-server context context-name [instance instance-name] [vrf vrf-name]
[topology topology-name]
DETAILED STEPS
Command or Action
Purpose
Step 1
switch# configuration terminal
Enters global configuration mode.
Step 2
switch(config)# snmp-server context context-name Maps an SNMP context to a protocol instance, VRF, or topology.
[instance instance-name] [vrf vrf-name] [topology The names can be any alphanumeric string up to 32 characters.
topology-name]
Step 3
switch(config)# snmp-server mib
community-map community-name context
context-name
Maps an SNMPv2c community to an SNMP context. The names
can be any alphanumeric string up to 32 characters.
Step 4
switch(config)# no snmp-server context
context-name [instance instance-name] [vrf
vrf-name] [topology topology-name]
(Optional)
Deletes the mapping between an SNMP context and a protocol
instance, VRF, or topology. The names can be any alphanumeric
string up to 32 characters.
Note
Do not enter an instance, VRF, or topology to delete a
context mapping. If you use the instance, vrf, or topology
keywords, you configure a mapping between the context
and a zero-length string.
Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)
OL-25846-01
19
Configuring SNMP
Disabling SNMP
Disabling SNMP
SUMMARY STEPS
1. configure terminal
2. switch(config) # no snmp-server protocol enable
DETAILED STEPS
Step 1
Command or Action
Purpose
configure terminal
Enters global configuration mode.
Example:
switch# configure terminal
switch(config)#
Step 2
switch(config) # no snmp-server protocol enable
Disables SNMP.
SNMP is disabled by default.
Example:
no snmp-server protocol enable
Verifying the SNMP Configuration
To display SNMP configuration information, perform one of the following tasks:
Command
Purpose
show snmp
Displays the SNMP status.
show snmp community
Displays the SNMP community strings.
show snmp engineID
Displays the SNMP engineID.
show snmp group
Displays SNMP roles.
show snmp sessions
Displays SNMP sessions.
show snmp trap
Displays the SNMP notifications enabled or disabled.
show snmp user
Displays SNMPv3 users.
Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)
20
OL-25846-01
Configuring SNMP
Feature History for SNMP
Feature History for SNMP
Table 4: Feature History for SNMP
Feature Name
Releases
Information
IPv6 support
5.2(1)N1(1)
This feature was introduced.
Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)
OL-25846-01
21
Configuring SNMP
Feature History for SNMP
Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)
22
OL-25846-01
Source Exif Data:
File Type : PDF File Type Extension : pdf MIME Type : application/pdf PDF Version : 1.4 Linearized : No Page Mode : UseOutlines Page Count : 22 Language : en Description : Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1) -Configuring SNMP Producer : XEP 4.9 build 20070312; modified using iText 2.1.7 by 1T3XT Access Level : Customer,Guest,Partner Secondary Concept : Ia Path : Content Type : cisco.com#US Modify Date : 2015:07:02 00:48:29-07:00 Trapped : False Entitlement Expression : contains( "0,1,2,3,4,7" , $profileField[3] ) Title : Configuring SNMP Alfresco Doc Version : Creator : Unknown Doc Type : Country : US Document Id : Alfresco Trace ID : Concept : Create Date : 2015:07:02 02:33:59 Author : Unknown Date : 2015-07-01T23:36:36.747-07:00EXIF Metadata provided by EXIF.tools