Cisco – SNMP configuration on a Cisco switch

ciscomonitoringsnmpswitch

I need to configure SNMP on a Cisco switch and link it to SNMP 1.1.1.1 SolarWinds server. Please suggest commands for the switch.

We are using SNMPv3 with MD5 auth entication.

Best Answer

Cisco has all sorts of guides to configuring SNMP. For instance: Configuring SNMP. It is possible that some switches or IOS versions will vary. There are also some decision to be made, such as SNMP ACLs, which notifications, etc. You will need to make some decision and customize your configuration.

SNMP Configuration Guidelines

If the switch starts and the switch startup configuration has at least one snmp-server global configuration command, the SNMP agent is enabled.

An SNMP group is a table that maps SNMP users to SNMP views. An SNMP user is a member of an SNMP group. An SNMP host is the recipient of an SNMP trap operation. An SNMP engine ID is a name for the local or remote SNMP engine.

When configuring SNMP, follow these guidelines:

  • When configuring an SNMP group, do not specify a notify view. The snmp-server host global configuration command autogenerates a notify view for the user and then adds it to the group associated with that user. Modifying the group's notify view affects all users associated
    with that group. See the Cisco IOS Network Management Command Reference for information about when you should configure notify views.
  • To configure a remote user, specify the IP address or port number for the remote SNMP agent of the device where the user resides.
  • Before you configure remote users for a particular agent, configure the SNMP engine ID, using the snmp-server engineID global configuration with the remote option. The remote agent's SNMP engine ID and user password are used to compute the authentication and privacy digests. If you do not configure the remote engine ID first, the configuration command fails.
  • When configuring SNMP informs, you need to configure the SNMP engine ID for the remote agent in the SNMP database before you can send proxy requests or informs to it.
  • If a local user is not associated with a remote host, the switch does not send informs for the auth (authNoPriv) and the priv (authPriv) authentication levels.
  • Changing the value of the SNMP engine ID has important side effects. A user's password (entered on the command line) is converted to an MD5 or SHA security digest based on the password and the local engine ID. The command-line password is then destroyed, as required by RFC 2274. Because of this deletion, if the value of the engine ID changes, the security digests of SNMPv3 users become invalid, and you need to reconfigure SNMP users by using the snmp-server user username global configuration command. Similar restrictions require the reconfiguration of community strings when the engine ID changes.
Related Topic