SNMP in Cisco IOS. The minimum you should know

Transcription

1 The minimum you should know

2 SNMP Framework Manager Agent MIB i.e. Cisco Works (or better something that really works) Software component on managed device Collection of objects/variables a manager can set or get Karsten Iwen - CCIE #14602 (Security, R/S) 2

3 Two main-functions: The SNMP manager polls information from the agent or sets parameters on the agent. uses UDP-port 161 The SNMP agent sends unsolicited notifications to the SNMP manager (agent-initiated). traps informs (traps with acknowlegement) uses UDP-port Karsten Iwen - CCIE #14602 (Security, R/S) 3

4 SNMP Security-Models SNMPv1, SNMPv2c: Security is Not My Problem Authentication based on community-string SNMPv3: noauthnopriv: Usernames for authentication authnopriv: adds HMAC authentication authpriv: adds encryption Karsten Iwen - CCIE #14602 (Security, R/S) 4

5 configuring SNMP Basic-config: Router(config)#snmp-server contact Karsten Iwen Router(config)#snmp-server location Kitchen - Coffee-Maker Router(config)#snmp-server chassis-id PavoniXM Karsten Iwen - CCIE #14602 (Security, R/S) 5

6 configuring SNMPv1 and v2c Setting up access-rules: Router(config)#snmp-server community weakpw? <1-99> Std IP accesslist allowing access with this community string < > Expanded IP accesslist allowing access with this community string WORD Access-list name ipv6 Specify IPv6 Named Access-List ro Read-only access with this community string rw Read-write access with this community string view Restrict this community to a named MIB view <cr> Karsten Iwen - CCIE #14602 (Security, R/S) 6

7 configuring SNMPv1 and v2c Setting up Trap-destinations: Router(config)#snmp-server host ? WORD SNMPv1/v2c community string or SNMPv3 user name informs Send Inform messages to this host traps Send Trap messages to this host version SNMP version to use for notification messages Router(config)#snmp-server trap-source loopback 0 Karsten Iwen - CCIE #14602 (Security, R/S) 7

8 configuring SNMPv1 and v2c Specifying what to send: Router(config)#snmp-server enable traps? atm Enable SNMP atm traps cnpd Enable NBAR Protocol Discovery traps config Enable SNMP config traps... Router(config)#snmp-server enable traps ospf? cisco-specific Cisco specific traps errors Error traps lsa Lsa related traps rate-limit Trap rate limit values retransmit Packet retransmit traps state-change State change traps <cr> Karsten Iwen - CCIE #14602 (Security, R/S) 8

9 the SNMPv3 security-model SNMP-Engines Groups Users Requirements IOS 12.0(3)T crypto-image for SNMP-priv Karsten Iwen - CCIE #14602 (Security, R/S) 9

10 configuring SNMPv3 SNMP-Engines Router#sh snmp engineid Local SNMP engineid: C20007CF0000 Remote Engine ID IP-addr Port Router(config)#snmp-server engineid local abcdef Router#sh snmp engineid Local SNMP engineid: ABCDEF Remote Engine ID IP-addr Port Karsten Iwen - CCIE #14602 (Security, R/S) 10

11 configuring SNMPv3 SNMP-Groups Router#sh snmp group groupname: ILMI readview : *ilmi notifyview: <no notifyview specified> row status: active security model:v1 writeview: *ilmi groupname: ILMI readview : *ilmi notifyview: <no notifyview specified> row status: active security model:v2c writeview: *ilmi Karsten Iwen - CCIE #14602 (Security, R/S) 11

12 configuring SNMPv3 SNMP-Groups Router(config)#snmp-server group SecOps v3 priv access SNMP-ACL-SECOPS Router#sh run i snmp-server group snmp-server group SecOps v3 priv access SNMP-ACL-SECOPS Router#sh snmp group... groupname: SecOps security model:v3 priv readview : v1default writeview: <no writeview specified> notifyview: <no notifyview specified> row status: active access-list: SNMP-ACL-SECOPS Karsten Iwen - CCIE #14602 (Security, R/S) 12

13 configuring SNMPv3 SNMP-Users Router(config)#snmp-server user BOFH SecOps v3 auth sha PW1 priv des56 PW2 Router#sh run i snmp-server user Router# Router#sh snmp user User name: BOFH Engine ID: ABCDEF storage-type: nonvolatile Authentication Protocol: SHA Privacy Protocol: DES Group-name: SecOps active Karsten Iwen - CCIE #14602 (Security, R/S) 13

14 configuring SNMPv3 sending notifications Router(config)#snmp-server host traps version 3 auth BOFH? atm Allow SNMP atm traps cnpd Allow NBAR Protocol Discovery traps config Allow SNMP config traps... Karsten Iwen - CCIE #14602 (Security, R/S) 14

15 SNMP Misc. By default, the system can not be rebooted through snmp: Router(config)#snmp-server system-shutdown A manager can request to load or save the config from a tftp-server. That should be limited: Router(config)#snmp-server tftp-server-list? <1-99> IP standard access list WORD Access-list name Interface-descriptions are limited to 64 characters by default. Router(config)#snmp ifmib ifalias long Karsten Iwen - CCIE #14602 (Security, R/S) 15