Configuring SNMP 25846 B Cisco N5k System Mgmt Cg Rel 513 N1 1 Chapter 01110

User Manual: 25846

Open the PDF directly: View PDF .
Page Count: 22

Configuring SNMP

This chapter contains the following sections:

•Information About SNMP, page 1

•Licensing Requirements for SNMP, page 5

•Guidelines and Limitations for SNMP, page 6

•Default SNMP Settings, page 6

•Configuring SNMP, page 6

•Disabling SNMP, page 20

•Verifying the SNMP Configuration, page 20

•Feature History for SNMP, page 21

Information About SNMP

The Simple Network Management Protocol (SNMP) is an application-layer protocol that provides a message

format for communication between SNMP managers and agents. SNMP provides a standardized framework

and a common language used for the monitoring and management of devices in a network.

SNMP Functional Overview

The SNMP framework consists of three parts:

•An SNMP manager—The system used to control and monitor the activities of network devices using

SNMP.

•An SNMP agent—The software component within the managed device that maintains the data for the

device and reports these data, as needed, to managing systems. The Cisco Nexus device supports the

agent and MIB. To enable the SNMP agent, you must define the relationship between the manager and

the agent.

•A managed information base (MIB)—The collection of managed objects on the SNMP agent

Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)

OL-25846-01 1

Cisco NX-OS does not support SNMP sets for Ethernet MIBs.Note

The Cisco Nexus device supports SNMPv1, SNMPv2c, and SNMPv3. Both SNMPv1 and SNMPv2c use a

community-based form of security.

Cisco NX-OS supports SNMP over IPv6.

SNMP is defined in RFC 3410 (http://tools.ietf.org/html/rfc3410), RFC 3411 (http://tools.ietf.org/html/rfc3411),

RFC 3412 (http://tools.ietf.org/html/rfc3412), RFC 3413 (http://tools.ietf.org/html/rfc3413), RFC 3414 (http:/

/tools.ietf.org/html/rfc3414), RFC 3415 (http://tools.ietf.org/html/rfc3415), RFC 3416 (http://tools.ietf.org/

html/rfc3416), RFC 3417 (http://tools.ietf.org/html/rfc3417), RFC 3418 (http://tools.ietf.org/html/rfc3418),

and RFC 3584 (http://tools.ietf.org/html/rfc3584).

SNMP Notifications

A key feature of SNMP is the ability to generate notifications from an SNMP agent. These notifications do

not require that requests be sent from the SNMP manager. Notifications can indicate improper user

authentication, restarts, the closing of a connection, loss of connection to a neighbor router, or other significant

events.

Cisco NX-OS generates SNMP notifications as either traps or informs. A trap is an asynchronous,

unacknowledged message sent from the agent to the SNMP managers listed in the host receiver table. Informs

are asynchronous messages sent from the SNMP agent to the SNMP manager which the manager must

acknowledge receipt of.

Traps are less reliable than informs because the SNMP manager does not send any acknowledgment when it

receives a trap. The switch cannot determine if the trap was received. An SNMP manager that receives an

inform request acknowledges the message with an SNMP response protocol data unit (PDU). If the Cisco

Nexus device never receives a response, it can send the inform request again.

You can configure Cisco NX-OS to send notifications to multiple host receivers.

SNMPv3

SNMPv3 provides secure access to devices by a combination of authenticating and encrypting frames over

the network. The security features provided in SNMPv3 are the following:

•Message integrity—Ensures that a packet has not been tampered with in-transit.

•Authentication—Determines the message is from a valid source.

•Encryption—Scrambles the packet contents to prevent it from being seen by unauthorized sources.

SNMPv3 provides for both security models and security levels. A security model is an authentication strategy

that is set up for a user and the role in which the user resides. A security level is the permitted level of security

within a security model. A combination of a security model and a security level determines which security

mechanism is employed when handling an SNMP packet.

Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)

2OL-25846-01

Configuring SNMP

SNMP Notifications

Security Models and Levels for SNMPv1, v2, and v3

The security level determines if an SNMP message needs to be protected from disclosure and if the message

needs to be authenticated. The various security levels that exist within a security model are as follows:

•noAuthNoPriv—Security level that does not provide authentication or encryption.

•authNoPriv—Security level that provides authentication but does not provide encryption.

•authPriv—Security level that provides both authentication and encryption.

Three security models are available: SNMPv1, SNMPv2c, and SNMPv3. The security model combined with

the security level determine the security mechanism applied when the SNMP message is processed.

Table 1: SNMP Security Models and Levels

What HappensEncryptionAuthenticationLevelModel

Uses a community

string match for

authentication.

NoCommunity stringnoAuthNoPrivv1

Uses a community

string match for

authentication.

NoCommunity stringnoAuthNoPrivv2c

Uses a username

match for

authentication.

NoUsernamenoAuthNoPrivv3

Provides

authentication based

on the Hash-Based

Message

Authentication Code

(HMAC) Message

Digest 5 (MD5)

algorithm or the

HMAC Secure Hash

Algorithm (SHA).

NoHMAC-MD5 or

HMAC-SHA

authNoPrivv3

Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)

OL-25846-01 3

Configuring SNMP

SNMPv3

What HappensEncryptionAuthenticationLevelModel

Provides

authentication based

on the HMAC-MD5

or HMAC-SHA

algorithms. Provides

Data Encryption

Standard (DES)

56-bit encryption in

addition to

authentication based

on the Cipher Block

Chaning (CBC)

DES (DES-56)

standard.

DESHMAC-MD5 or

HMAC-SHA

authPrivv3

User-Based Security Model

SNMPv3 User-Based Security Model (USM) refers to SNMP message-level security and offers the following

services:

•Message integrity—Ensures that messages have not been altered or destroyed in an unauthorized manner

and that data sequences have not been altered to an extent greater than can occur nonmaliciously.

•Message origin authentication—Confirms that the claimed identity of the user who received the data

was originated.

•Message confidentiality—Ensures that information is not made available or disclosed to unauthorized

individuals, entities, or processes.

SNMPv3 authorizes management operations only by configured users and encrypts SNMP messages.

Cisco NX-OS uses two authentication protocols for SNMPv3:

•HMAC-MD5-96 authentication protocol

•HMAC-SHA-96 authentication protocol

Cisco NX-OS uses Advanced Encryption Standard (AES) as one of the privacy protocols for SNMPv3 message

encryption and conforms with RFC 3826.

The priv option offers a choice of DES or 128-bit AES encryption for SNMP security encryption. The priv

option and the aes-128 token indicates that this privacy password is for generating a 128-bit AES key #.The

AES priv password can have a minimum of eight characters. If the passphrases are specified in clear text, you

can specify a maximum of 64 characters. If you use the localized key, you can specify a maximum of 130

characters.

For an SNMPv3 operation using the external AAA server, you must use AES for the privacy protocol in

user configuration on the external AAA server.

Note

Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)

4OL-25846-01

Configuring SNMP

SNMPv3

CLI and SNMP User Synchronization

SNMPv3 user management can be centralized at the Access Authentication and Accounting (AAA) server

level. This centralized user management allows the SNMP agent in Cisco NX-OS to leverage the user

authentication service of the AAA server. Once user authentication is verified, the SNMP PDUs are processed

further. Additionally, the AAA server is also used to store user group names. SNMP uses the group names to

apply the access/role policy that is locally available in the switch.

Any configuration changes made to the user group, role, or password results in database synchronization for

both SNMP and AAA.

Cisco NX-OS synchronizes user configuration in the following ways:

•The auth passphrase specified in the snmp-server user command becomes the password for the CLI

user.

•The password specified in the username command becomes the auth and priv passphrases for the

SNMP user.

•If you create or delete a user using either SNMP or the CLI, the user is created or deleted for both SNMP

and the CLI.

•User-role mapping changes are synchronized in SNMP and the CLI.

•Role changes (deletions or modifications from the CLI) are synchronized to SNMP.

When you configure passphrase/password in localized key/encrypted format, Cisco NX-OS does not

synchronize the user information (passwords, rules, etc.).

Note

Group-Based SNMP Access

Because a group is a standard SNMP term used industry-wide, roles are referred to as groups in this SNMP

section.

Note

SNMP access rights are organized by groups. Each group in SNMP is similar to a role through the CLI. Each

group is defined with three accesses: read access, write access, and notification access. Each access can be

enabled or disabled within each group.

You can begin communicating with the agent once your username is created, your roles are set up by your

administrator, and you are added to the roles.

Licensing Requirements for SNMP

This feature does not require a license. Any feature not included in a license package is bundled with the Cisco

NX-OS system images and is provided at no extra charge to you. For a complete explanation of the Cisco

NX-OS licensing scheme, see the Cisco NX-OS Licensing Guide.

Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)

OL-25846-01 5

Configuring SNMP

Licensing Requirements for SNMP

Guidelines and Limitations for SNMP

Cisco NX-OS supports read-only access to Ethernet MIBs.

For more information about supported MIBs, see the following URL:

http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml

Default SNMP Settings

Table 2: Default SNMP Parameters

DefaultParameters

Enabledlicense notifications

ietf-extendedlinkUp/Down notification type

Configuring SNMP

Configuring SNMP Users

The commands used to configure SNMP users in Cisco NX-OS are different from those used to configure

users in Cisco IOS.

Note

SUMMARY STEPS

1. configure terminal

2. switch(config)# snmp-server user name [auth {md5 |sha}passphrase [auto] [priv [aes-128]passphrase]

[engineID id] [localizedkey]]

3. (Optional) switch# show snmp user

4. (Optional) copy running-config startup-config

Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)

6OL-25846-01

Configuring SNMP

Guidelines and Limitations for SNMP

DETAILED STEPS

PurposeCommand or Action

Enters global configuration mode.configure terminal

Example:

switch# configure terminal

switch(config)#

Step 1

Configures an SNMP user with authentication and privacy

parameters.

switch(config)# snmp-server user name [auth {md5

|sha}passphrase [auto] [priv [aes-128]passphrase]

[engineID id] [localizedkey]]

Step 2

The passphrase can be any case-sensitive, alphanumeric string

up to 64 characters.

Example:

switch(config)# snmp-server user Admin auth

sha abcd1234 priv abcdefgh

If you use the localizedkey keyword, the passphrase can be any

case-sensitive, alphanumeric string up to 130 characters.

The engineID format is a 12-digit, colon-separated decimal

number.

(Optional)

Displays information about one or more SNMP users.

switch# show snmp user

Example:

switch(config) # show snmp user

Step 3

(Optional)

Saves the change persistently through reboots and restarts by

copying the running configuration to the startup configuration.

copy running-config startup-config

Example:

switch(config)# copy running-config

startup-config

Step 4

The following example shows how to configure an SNMP user:

switch# config t

Enter configuration commands, one per line. End with CNTL/Z.

switch(config)# snmp-server user Admin auth sha abcd1234 priv abcdefgh

Enforcing SNMP Message Encryption

You can configure SNMP to require authentication or encryption for incoming requests. By default, the SNMP

agent accepts SNMPv3 messages without authentication and encryption. When you enforce privacy, Cisco

NX-OS responds with an authorization error for any SNMPv3 PDU request that uses a security level parameter

of either noAuthNoPriv or authNoPriv.

Use the following command in global configuration mode to enforce SNMP message encryption for a specific

user:

PurposeCommand

Enforces SNMP message encryption for this user.

switch(config)# snmp-server user name enforcePriv

Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)

OL-25846-01 7

Configuring SNMP

Enforcing SNMP Message Encryption

Use the following command in global configuration mode to enforce SNMP message encryption for all users:

PurposeCommand

Enforces SNMP message encryption for all users.switch(config)# snmp-server globalEnforcePriv

Assigning SNMPv3 Users to Multiple Roles

After you configure an SNMP user, you can assign multiple roles for the user.

Only users who belong to a network-admin role can assign roles to other users.Note

PurposeCommand

Associates this SNMP user with the configured user

role.

switch(config)# snmp-server user name group

Creating SNMP Communities

You can create SNMP communities for SNMPv1 or SNMPv2c.

PurposeCommand

Creates an SNMP community string.

switch(config)# snmp-server community name

group {ro |rw}

Filtering SNMP Requests

You can assign an access list (ACL) to a community to filter incoming SNMP requests. If the assigned ACL

allows the incoming request packet, SNMP processes the request. If the ACL denies the request, SNMP drops

the request and sends a system message.

Create the ACL with the following parameters:

•Source IP address

•Destination IP address

•Source port

•Destination port

•Protocol (UDP or TCP)

The ACL applies to both IPv4 and IPv6 over UDP and TCP. After creating the ACL, assign the ACL to the

SNMP community.

Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)

8OL-25846-01

Configuring SNMP

Assigning SNMPv3 Users to Multiple Roles

For more information about creating ACLs, see the NX-OS security configuration guide for the Cisco

Nexus Series software that you are using.

Tip

Use the following command in global configuration mode to assign an ACL to a community to filter SNMP

requests:

PurposeCommand

Assigns an ACL to an SNMP community to filter

SNMP requests.

switch(config)# snmp-server community community

name use-acl acl-name

Example:

switch(config)# snmp-server community public

use-acl my_acl_for_public

Configuring SNMP Notification Receivers

You can configure Cisco NX-OS to generate SNMP notifications to multiple host receivers.

You can configure a host receiver for SNMPv1 traps in a global configuration mode.

PurposeCommand

Configures a host receiver for SNMPv1 traps. The

ip-address can be an IPv4 or IPv6 address. The

community can be any alphanumeric string up to 255

characters. The UDP port number range is from 0 to

65535.

switch(config)# snmp-server host ip-address traps

version 1 community [udp_port number]

You can configure a host receiver for SNMPv2c traps or informs in a global configuration mode.

PurposeCommand

Configures a host receiver for SNMPv2c traps or

informs. The ip-address can be an IPv4 or IPv6

address. The community can be any alphanumeric

string up to 255 characters. The UDP port number

range is from 0 to 65535.

switch(config)# snmp-server host ip-address {traps

|informs}version 2c community [udp_port number]

You can configure a host receiver for SNMPv3 traps or informs in a global configuration mode.

PurposeCommand

Configures a host receiver for SNMPv2c traps or

informs. The ip-address can be an IPv4 or IPv6

address. The username can be any alphanumeric string

up to 255 characters. The UDP port number range is

from 0 to 65535.

switch(config)# snmp-server host ip-address {traps

|informs}version 3 {auth |noauth |priv}username

[udp_port number]

Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)

OL-25846-01 9

Configuring SNMP

Configuring SNMP Notification Receivers

The SNMP manager must know the user credentials (authKey/PrivKey) based on the SNMP engineID of

the Cisco Nexus device to authenticate and decrypt the SNMPv3 messages.

Note

The following example shows how to configure a host receiver for an SNMPv1 trap:

switch(config)# snmp-server host 192.0.2.1 traps version 1 public

The following example shows how to configure a host receiver for an SNMPv2 inform:

switch(config)# snmp-server host 192.0.2.1 informs version 2c public

The following example shows how to configure a host receiver for an SNMPv3 inform:

switch(config)# snmp-server host 192.0.2.1 informs version 3 auth NMS

Configuring SNMP Notification Receivers with VRFs

You can configure Cisco NX-OS to use a configured VRF to reach the host receiver. SNMP adds entries into

the cExtSnmpTargetVrfTable of the CISCO-SNMP-TARGET-EXT-MIB when you configure the VRF

reachability and filtering options for an SNMP notification receiver.

You must configure the host before configuring the VRF reachability or filtering options.Note

SUMMARY STEPS

1. switch# configure terminal

2. switch# snmp-server host ip-address use-vrf vrf_name [udp_port number]

3. (Optional) switch(config)# copy running-config startup-config

DETAILED STEPS

PurposeCommand or Action

Enters global configuration mode.switch# configure terminal

Step 1

Configures SNMP to use the selected VRF to communicate with the host

receiver. The IP address can be an IPv4 or IPv6 address. The VRF name

switch# snmp-server host ip-address

use-vrf vrf_name [udp_port number]

Step 2

can be any alphanumeric string up to 255 characters. The UDP port number

range is from 0 to 65535. This command adds an entry into thc

ExtSnmpTargetVrfTable of the CISCO-SNMP-TARGET-EXT-MB.

(Optional)

Saves the change persistently through reboots and restarts by copying the

running configuration to the startup configuration.

switch(config)# copy running-config

startup-config

Step 3

Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)

10 OL-25846-01

Configuring SNMP

Configuring SNMP Notification Receivers with VRFs

The following example shows how to configure the SNMP server host with IP address 192.0.2.1 to use the

VRF named "Blue:"

switch# configuration terminal

switch(config)# snmp-server host 192.0.2.1 use-vrf Blue

switch(config)# copy running-config startup-config

Filtering SNMP Notifications Based on a VRF

You can configure Cisco NX-OS filter notifications based on the VRF in which the notification occurred.

SUMMARY STEPS

1. switch# configure terminal

2. switch(config)# snmp-server host ip-address filter-vrf vrf_name [udp_port number]

3. (Optional) switch(config)# copy running-config startup-config

DETAILED STEPS

PurposeCommand or Action

Enters global configuration mode.switch# configure terminal

Step 1

Filters notifications to the notification host receiver based on the configured

VRF. The IP address can be an IPv4 or IPv6 address. The VRF name can

switch(config)# snmp-server host

ip-address filter-vrf vrf_name [udp_port

number]

Step 2

be any alphanumeric string up to 255 characters. The UDP port number

range is from 0 to 65535.

This command adds an entry into thc ExtSnmpTargetVrfTable of the

CISCO-SNMP-TARGET-EXT-MB.

(Optional)

Saves the change persistently through reboots and restarts by copying the

running configuration to the startup configuration.

switch(config)# copy running-config

startup-config

Step 3

The following example shows how to configure filtering of SNMP notifications based on a VRF:

switch# configuration terminal

switch(config)# snmp-server host 192.0.2.1 filter-vrf Red

switch(config)# copy running-config startup-config

Configuring a Source Interface for Sending Out All SNMP Notifications

You can configure SNMP to use the IP address of an interface as the source IP address for notifications. When

a notification is generated, its source IP address is based on the IP address of this configured interface.

Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)

OL-25846-01 11

Configuring SNMP

Filtering SNMP Notifications Based on a VRF

Configuring the source interface IP address for outgoing trap packets does not guarantee that the device

will use the same interface to send the trap. The source interface IP address defines the source address

inside of the SNMP trap and the connection is opened with the address of the egress interface as source.

Note

Complete the following steps to configure a source interface for sending out all SNMP notifications:

SUMMARY STEPS

1. configure terminal

2. switch(config) # snmp-server source-interface {traps |informs}if-type if-number

DETAILED STEPS

PurposeCommand or Action

Enters global configuration mode.configure terminal

Example:

switch# configure terminal

switch(config)#

Step 1

Configures a source interface for sending out

SNMPv2c traps or informs. Use ?to determine the

supported interface types.

switch(config) # snmp-server source-interface {traps |

informs}if-type if-number

Example:

switch(config) # snmp-server

source-interface traps ethernet 2/1

Step 2

This example shows how to configure a source interface to sending out SNMPv2c traps:

switch# configure terminal

switch(config) # snmp-server source-interface traps ethernet 2/1

What to Do Next

To display information about configured source interfaces, enter the show snmp source-interface command.

Configuring a Host Receiver for SNMP Notifications

This configuration overrides the global source interface configuration.Note

Complete the following steps to configure a host receiver on a source interface responsible for receiving all

SNMP notifications:

Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)

12 OL-25846-01

Configuring SNMP

Configuring a Host Receiver for SNMP Notifications

SUMMARY STEPS

1. configure terminal

2. switch(config) # snmp-server host ip-address source-interface if-type if-number [udp_port number]

DETAILED STEPS

PurposeCommand or Action

Enters global configuration mode.configure terminal

Example:

switch# configure terminal

switch(config)#

Step 1

Configures a host receiver for SNMPv2c traps or

informs. The ip-address can be an IPv4 or IPv6 address.

Use ?to determine the supported interface types.

switch(config) # snmp-server host ip-address source-interface

if-type if-number [udp_port number]

Example:

switch(config) # snmp-server host 192.0.2.1

source-interface traps ethernet 2/1

Step 2

To the following example configures a source interface responsible for receiving all SNMP notifications:

switch# config t

switch(config) # snmp-server host 192.0.2.1 source-interface ethernet 2/1

What to Do Next

To display information about configured source interface, enter the show snmp source-interface command.

Configuring SNMP for Inband Access

You can configure SNMP for inband access using the following:

•Using SNMP v2 without context—You can use a community that is mapped to a context. In this case,

the SNMP client does not need to know about the context.

•Using SNMP v2 with context—The SNMP client needs to specify the context by specifying a community;

for example, <community>@<context>.

•Using SNMP v3—You can specify the context.

SUMMARY STEPS

1. switch# configuration terminal

2. switch(config)# snmp-server context context-name vrf vrf-name

3. switch(config)# snmp-server community community-name group group-name

4. switch(config)# snmp-server mib community-map community-name context context-name

Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)

OL-25846-01 13

Configuring SNMP

Configuring SNMP for Inband Access

DETAILED STEPS

PurposeCommand or Action

Enters global configuration mode.switch# configuration terminal

Step 1

Maps an SNMP context to the management VRF or default VRF.

Custom VRFs are not supported.

switch(config)# snmp-server context

context-name vrf vrf-name

Step 2

The names can be any alphanumeric string up to 32 characters.

Maps an SNMPv2c community to an SNMP context and identifies

the group to which the community belongs. The names can be any

alphanumeric string up to 32 characters.

switch(config)# snmp-server community

community-name group group-name

Step 3

Maps an SNMPv2c community to an SNMP context. The names

can be any alphanumeric string up to 32 characters.

switch(config)# snmp-server mib

community-map community-name context

context-name

Step 4

The following SNMPv2 example shows how to map a community named snmpdefault to a context:

switch# config t

Enter configuration commands, one per line. End with CNTL/Z.

switch(config)# snmp-server context def vrf default

switch(config)# snmp-server community snmpdefault group network-admin

switch(config)# snmp-server mib community-map snmpdefault context def

switch(config)#

The following SNMPv2 example shows how to configure and inband access to the community comm which

is not mapped:

switch# config t

Enter configuration commands, one per line. End with CNTL/Z.

switch(config)# snmp-server context def vrf default

switch(config)# snmp-server community comm group network-admin

switch(config)#

The following SNMPv3 example shows how to use a v3 username and password:

switch# config t

Enter configuration commands, one per line. End with CNTL/Z.

switch(config)# snmp-server context def vrf default

switch(config)#

Enabling SNMP Notifications

You can enable or disable notifications. If you do not specify a notification name, Cisco NX-OS enables all

notifications.

The snmp-server enable traps CLI command enables both traps and informs, depending on the configured

notification host receivers.

Note

The following table lists the CLI commands that enable the notifications for Cisco NX-OS MIBs.

Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)

14 OL-25846-01

Configuring SNMP

Enabling SNMP Notifications

Table 3: Enabling SNMP Notifications

Related CommandsMIB

snmp-server enable trapsAll notifications

snmp-server enable traps bridge newroot

snmp-server enable traps bridge topologychange

BRIDGE-MIB

snmp-server enable traps aaaCISCO-AAA-SERVER-MIB

snmp-server enable traps entity

snmp-server enable traps entity fru

ENITY-MIB,

CISCO-ENTITY-FRU-CONTROL-MIB,

CISCO-ENTITY-SENSOR-MIB

snmp-server enable traps licenseCISCO-LICENSE-MGR-MIB

snmp-server enable traps linkIF-MIB

snmp-server enable traps port-securityCISCO-PSM-MIB

snmp-server enable traps snmp

snmp-server enable traps snmp authentication

SNMPv2-MIB

snmp-server enable traps fccCISCO-FCC-MIB

snmp-server enable traps fcdomainCISCO-DM-MIB

snmp-server enable traps fcnsCISCO-NS-MIB

snmp-server enable traps fcs discovery-complete

snmp-server enable traps fcs request-reject

CISCO-FCS-MIB

snmp-server enable traps fdmiCISCO-FDMI-MIB

snmp-server enable traps fspfCISCO-FSPF-MIB

snmp-server enable traps port-securityCISCO-PSM-MIB

snmp-server enable traps rscn

snmp-server enable traps rscn els

snmp-server enable traps rscn ils

CISCO-RSCN-MIB

Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)

OL-25846-01 15

Configuring SNMP

Enabling SNMP Notifications

Related CommandsMIB

snmp-server enable traps zone

snmp-server enable traps zone

default-zone-behavior-change

snmp-server enable traps zone

enhanced-zone-db-change

snmp-server enable traps zone merge-failure

snmp-server enable traps zone merge-success

snmp-server enable traps zone request-reject

snmp-server enable traps zone unsupp-mem

CISCO-ZS-MIB

snmp-server enable traps configCISCO-CONFIG-MAN-MIB

Supports no MIB objects except the

following notification:

ccmCLIRunningConfigChanged

Note

The license notifications are enabled by default.Note

To enable the specified notification in the global configuration mode, perform one of the following tasks:

PurposeCommand

Enables all SNMP notifications.switch(config)# snmp-server enable traps

Enables the AAA SNMP notifications.switch(config)# snmp-server enable traps aaa

[server-state-change]

Enables the ENTITY-MIB SNMP notifications.switch(config)# snmp-server enable traps entity

[fru]

Enables the license SNMP notification.switch(config)# snmp-server enable traps license

Enables the port security SNMP notifications.switch(config)# snmp-server enable traps

port-security

Enables the SNMP agent notifications.switch(config)# snmp-server enable traps snmp

[authentication]

Configuring Link Notifications

You can configure which linkUp/linkDown notifications to enable on a device. You can enable the following

types of linkUp/linkDown notifications:

•cieLinkDown—Enables the Cisco extended link state down notification.

Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)

16 OL-25846-01

Configuring SNMP

Configuring Link Notifications

•cieLinkUp—Enables the Cisco extended link state up notification.

•cisco-xcvr-mon-status-chg—Enables the Cisco interface transceiver monitor status change notification.

•delayed-link-state-change—Enables the delayed link state change.

•extended-linkUp—Enables the Internet Engineering Task Force (IETF) extended link state up notification.

•extended-linkDown—Enables the IETF extended link state down notification.

•linkDown—Enables the IETF Link state down notification.

•linkUp—Enables the IETF Link state up notification.

SUMMARY STEPS

1. configure terminal

2. snmp-server enable traps link [cieLinkDown |cieLinkUp |cisco-xcvr-mon-status-chg |

delayed-link-state-change] | extended-linkUp |extended-linkDown |linkDown |linkUp]

DETAILED STEPS

PurposeCommand or Action

Enters global configuration mode.configure terminal

Example:

switch# configure terminal

switch(config)#

Step 1

Enables the link SNMP notifications.snmp-server enable traps link [cieLinkDown |cieLinkUp |

cisco-xcvr-mon-status-chg |delayed-link-state-change] | extended-linkUp

|extended-linkDown |linkDown |linkUp]

Step 2

Example:

switch(config)# snmp-server enable traps link cieLinkDown

Disabling Link Notifications on an Interface

You can disable linkUp and linkDown notifications on an individual interface. You can use these limit

notifications on a flapping interface (an interface that transitions between up and down repeatedly).

SUMMARY STEPS

1. switch# configure terminal

2. switch(config)# interface type slot/port

3. switch(config -if)# no snmp trap link-status

Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)

OL-25846-01 17

Configuring SNMP

Disabling Link Notifications on an Interface

DETAILED STEPS

PurposeCommand or Action

Enters global configuration mode.switch# configure terminal

Step 1

Specifies the interface to be changed.

switch(config)# interface type slot/port

Step 2

Disables SNMP link-state traps for the interface. This

feature is enabled by default.

switch(config -if)# no snmp trap link-status

Step 3

Enabling One-Time Authentication for SNMP over TCP

You can enable a one-time authentication for SNMP over a TCP session.

PurposeCommand

Enables a one-time authentication for SNMP over a

TCP session. This feature is disabled by default.

switch(config)# snmp-server tcp-session [auth]

Assigning SNMP Switch Contact and Location Information

You can assign the switch contact information, which is limited to 32 characters (without spaces), and the

switch location.

SUMMARY STEPS

1. switch# configuration terminal

2. switch(config)# snmp-server contact name

3. switch(config)# snmp-server location name

4. (Optional) switch# show snmp

5. (Optional) switch# copy running-config startup-config

DETAILED STEPS

PurposeCommand or Action

Enters global configuration mode.switch# configuration terminal

Step 1

Configures sysContact, the SNMP contact name.

switch(config)# snmp-server contact name

Step 2

Configures sysLocation, the SNMP location.

switch(config)# snmp-server location name

Step 3

Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)

18 OL-25846-01

Configuring SNMP

Enabling One-Time Authentication for SNMP over TCP

PurposeCommand or Action

(Optional)

Displays information about one or more destination

profiles.

switch# show snmp

Step 4

(Optional)

Saves this configuration change.

switch# copy running-config startup-config

Step 5

Configuring the Context to Network Entity Mapping

You can configure an SNMP context to map to a logical network entity, such as a protocol instance or VRF.

SUMMARY STEPS

1. switch# configuration terminal

2. switch(config)# snmp-server context context-name [instance instance-name] [vrf vrf-name] [topology

topology-name]

3. switch(config)# snmp-server mib community-map community-name context context-name

4. (Optional) switch(config)# no snmp-server context context-name [instance instance-name] [vrf vrf-name]

[topology topology-name]

DETAILED STEPS

PurposeCommand or Action

Enters global configuration mode.switch# configuration terminal

Step 1

Maps an SNMP context to a protocol instance, VRF, or topology.

The names can be any alphanumeric string up to 32 characters.

switch(config)# snmp-server context context-name

[instance instance-name] [vrf vrf-name] [topology

topology-name]

Step 2

Maps an SNMPv2c community to an SNMP context. The names

can be any alphanumeric string up to 32 characters.

switch(config)# snmp-server mib

community-map community-name context

context-name

Step 3

(Optional)

Deletes the mapping between an SNMP context and a protocol

instance, VRF, or topology. The names can be any alphanumeric

string up to 32 characters.

switch(config)# no snmp-server context

context-name [instance instance-name] [vrf

vrf-name] [topology topology-name]

Step 4

Do not enter an instance, VRF, or topology to delete a

context mapping. If you use the instance,vrf, or topology

keywords, you configure a mapping between the context

and a zero-length string.

Note

Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)

OL-25846-01 19

Configuring SNMP

Configuring the Context to Network Entity Mapping

Disabling SNMP

SUMMARY STEPS

1. configure terminal

2. switch(config) # no snmp-server protocol enable

DETAILED STEPS

PurposeCommand or Action

Enters global configuration mode.configure terminal

Example:

switch# configure terminal

switch(config)#

Step 1

Disables SNMP.switch(config) # no snmp-server protocol enable

Step 2

Example:

no snmp-server protocol enable

SNMP is disabled by default.

Verifying the SNMP Configuration

To display SNMP configuration information, perform one of the following tasks:

PurposeCommand

Displays the SNMP status.show snmp

Displays the SNMP community strings.show snmp community

Displays the SNMP engineID.show snmp engineID

Displays SNMP roles.show snmp group

Displays SNMP sessions.show snmp sessions

Displays the SNMP notifications enabled or disabled.show snmp trap

Displays SNMPv3 users.show snmp user

Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)

20 OL-25846-01

Configuring SNMP

Disabling SNMP

Feature History for SNMP

Table 4: Feature History for SNMP

InformationReleasesFeature Name

This feature was introduced.5.2(1)N1(1)IPv6 support

Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)

OL-25846-01 21

Configuring SNMP

Feature History for SNMP

Cisco Nexus 5000 Series NX-OS System Management Configuration Guide, Release 5.1(3)N1(1)

22 OL-25846-01

Configuring SNMP

Feature History for SNMP