| Cisco Systems |
Simple Network Management Protocol (SNMP)Configuring SNMPConfiguration StepsConfiguring SNMP is a pretty straightforward process for which you only need a few commands. These five steps are all you need to run through to configure a Cisco device for SNMP access: 1. Configure where the traps are to be sent. 2. Enable SNMP read-write access to the router. 3. Configure SNMP contact information. 4. Configure SNMP location. 5. Configure an ACL to restrict SNMP access to the NMS hosts. The only required configuration is the IP address of the NMS station and the community string (which acts as a password or authentication string) because the other three are optional. Here’s an example of a typical SNMP router configuration: Configuration SyntaxRouter(config)#snmp-server host snmp-server-IPRouter(config)#snmp-server community community-password access-rights Router(config)#snmp-server location Location-name Router(config)#snmp-server contact Contact-name Router(config)#ip access-list standard Protect_NMS_Station Router(config-std-nacl)#permit host 192.168.10.254 Access rights Let’s define the SNMP read and write options. Read-only Gives authorized management stations read access to all objects in the MIB except the community strings and doesn’t allow write access Read-write Gives authorized management stations read and write access to all objects in the MIB but doesn’t allow access to the community strings Next we’ll explore a Cisco proprietary method of configuring redundant default gateways for hosts. Configuration ExampleRouter(config)#snmp-server host 1.2.3.4Router(config)#snmp-server community Todd rw Router(config)#snmp-server location Boulder Router(config)#snmp-server contact Todd Lammle Router(config)#ip access-list standard Protect_NMS_Station Router(config-std-nacl)#permit host 192.168.10.254 Entering the snmp-server command enables SNMPv1 on the Cisco device. You can enter the ACL directly in the SNMP configuration to provide security, using either a number or a name. Here is an example: Router(config)#snmp-server community Todd Protect_NMS_Station rw really need to work with a few of them to configure a basic SNMP trap setup on a router. First, I set the IP address of the NMS station where the router will send the traps; then I chose the community name of Todd with RW access (read-write), which means the NMS will be able to retrieve and modify MIB objects from the router. Location and contact information comes in really handy for troubleshooting the configuration. Make sure you understand that the ACL protects the NMS from access, not the devices with the agents! To obtain information from the MIB on the SNMP agent, you can use several different operations:GET: This operation is used to get information from the MIB to an SNMP agent. SET: This operation is used to get information to the MIB from an SNMP manager. WALK: This operation is used to list information from successive MIB objects within a specified MIB. TRAP: This operation is used by the SNMP agent to send a triggered piece of information to the SNMP manager. INFORM: This operation is the same as a trap, but it adds an acknowledgment that a trap does not provide. You are here: Home / Cisco ASA Firewall Configuration / How to Configure SNMP on Cisco ASA 5500 Firewall How to Configure SNMP on Cisco ASA 5500 Firewall SNMP stands for Simple Network Management Protocol. Up to ASA software 8.1, the SNMP version supported was v1 and v2c. The newest ASA software 8.2 supports also SNMP v3 which is the most secure snmp protocol version. asa snmp configuration The ASA works as an SNMP server (or agent), so you need also a Network Management System (NMS) which will act as the SNMP manager in order to provide network monitoring and management functionality. The NMS is basically a management server such as the CiscoWorks product. With the NMS you can either poll the ASA appliance to collect information, or the ASA appliance can send snmp traps (event notifications) to the NMS server. SNMP Traps are sent on UDP port 162 and SNMP poll uses UDP port 161. So, the ASA will listen on udp 161 and the NMS will listen on udp 162 and 161. Configuring SNMP on ASA Step1: Enable the snmp server on the ASA ASA(config)# snmp-server enable Step2: Identify the NMS host that can connect to the ASA for SNMP management ASA(config)# snmp-server host [interface_name][ ip_address] community [community string] Where “interface name” is the ASA interface through which the NMS can be reached, and “ip address” is the NMS address. “community string” is like a preshared password which must be configured on both the ASA and the NMS in order for the two elements to communicate. Step3: Specify the ASA community string ASA(config)# snmp-server community [community string] Step4: Enable the ASA to send snmp traps to the NMS ASA(config)# snmp-server enable traps [all | snmp [trap] [trap] ] The default configuration has all snmp traps enabled (snmp-server enable traps snmp authentication linkup linkdown coldstart). It is recommended to leave all traps enabled as the default setting. Configuration Example: ASA(config)# snmp-server enable ASA(config)# snmp-server host inside 10.1.1.100 community somesecretword ASA(config)# snmp-server community somesecretword ASA(config)# snmp-server enable traps snmp authentication linkup linkdown coldstart Configuration Example of SNMP v3 Currently the most secure SNMP version is v3. To configure this version you need first to create an SNMP group, then an SNMP server and lastly a host (NMS) which will communicate with the firewall for management purposes. Let’s configure SNMP v3 with the example below: ASA(config)# snmp-server enable ASA(config)# snmp-server group snmpgroup v3 auth <- create v3 group with authentication ASA(config)# snmp-server user administrator snmpgroup v3 auth sha strongpass <- create user “administrator” belonging to group “snmpgroup” ASA(config)#snmp-server host inside 10.1.1.1 version 3 administrator <- specify the NMS host |