Cisco SNMP v3 setup

Perl Net-SNMP SNMP v3 compatibility Auth & Priv support matrix

Configuration

  • User: xorux
  • Password: xorux4you
  • Security level: AuthPriv
  • Priv protocol: AES128
  • Auth protocol: SHA
    configure terminal
    snmp-server protocol enable
    
    # check available auth algorithms
    snmp-server user xormon auth ?
      md5  Use HMAC MD5 algorithm for authentication
      sha  Use HMAC SHA algorithm for authentication
    
    # use SHA and check available privacy algorithms
    snmp-server user xormon auth sha xorux4you priv ?
      aes-128  Use 128-bit AES algorithm for privacy
    
    # use AES-128, complete command should look like this
    snmp-server user xormon auth sha xorux4you priv aes-128 xorux4you
    
    # end configuration with Ctrl+Z
    
    Test:
    snmpwalk -v 3 -l authPriv -u xormon -A xorux4you -X xorux4you -a SHA -x AES 192.168.1.1:161 sysDescr
      SNMPv2-MIB::sysDescr.0 = STRING: "Cisco NX-OS(tm) m9100, Software (m9100-s2ek9-mz) ...
    

Notes

  • Auth and Priv passwords must have at least 8 characters
  • Use preferably AES128 if you are not sure that your Operating System supports higher AES in snmp-perl module
    Note that snmpwalk might work, just problem could be snmp-perl module only as it has different support matrix
  • When using AES256 privacy protocol, at least SHA256 must be used as authentication protocol

DES vrs AES

    Do not use old DES protocol, use AES instead.
    New Linuxes do not support DES protocol anyway, you might check if your operating systems supports it or does not
    If bellow cmd prints anything then DES is supported and you can use it, but try to avoid that
    openssl ciphers | grep  DES
    

Add SAN switch to XorMon

    Cisco SNMP v3 setup