The minimum you should know
SNMP Framework Manager Agent MIB i.e. Cisco Works (or better something that really works) Software component on managed device Collection of objects/variables a manager can set or get http://security-planet.de Karsten Iwen - CCIE #14602 (Security, R/S) 2
Two main-functions: The SNMP manager polls information from the agent or sets parameters on the agent. uses UDP-port 161 The SNMP agent sends unsolicited notifications to the SNMP manager (agent-initiated). traps informs (traps with acknowlegement) uses UDP-port 162 http://security-planet.de Karsten Iwen - CCIE #14602 (Security, R/S) 3
SNMP Security-Models SNMPv1, SNMPv2c: Security is Not My Problem Authentication based on community-string SNMPv3: noauthnopriv: Usernames for authentication authnopriv: adds HMAC authentication authpriv: adds encryption http://security-planet.de Karsten Iwen - CCIE #14602 (Security, R/S) 4
configuring SNMP Basic-config: Router(config)#snmp-server contact Karsten Iwen Router(config)#snmp-server location Kitchen - Coffee-Maker Router(config)#snmp-server chassis-id PavoniXM1234 http://security-planet.de Karsten Iwen - CCIE #14602 (Security, R/S) 5
configuring SNMPv1 and v2c Setting up access-rules: Router(config)#snmp-server community weakpw? <1-99> Std IP accesslist allowing access with this community string <1300-1999> Expanded IP accesslist allowing access with this community string WORD Access-list name ipv6 Specify IPv6 Named Access-List ro Read-only access with this community string rw Read-write access with this community string view Restrict this community to a named MIB view <cr> http://security-planet.de Karsten Iwen - CCIE #14602 (Security, R/S) 6
configuring SNMPv1 and v2c Setting up Trap-destinations: Router(config)#snmp-server host 10.10.10.10? WORD SNMPv1/v2c community string or SNMPv3 user name informs Send Inform messages to this host traps Send Trap messages to this host version SNMP version to use for notification messages Router(config)#snmp-server trap-source loopback 0 http://security-planet.de Karsten Iwen - CCIE #14602 (Security, R/S) 7
configuring SNMPv1 and v2c Specifying what to send: Router(config)#snmp-server enable traps? atm Enable SNMP atm traps cnpd Enable NBAR Protocol Discovery traps config Enable SNMP config traps... Router(config)#snmp-server enable traps ospf? cisco-specific Cisco specific traps errors Error traps lsa Lsa related traps rate-limit Trap rate limit values retransmit Packet retransmit traps state-change State change traps <cr> http://security-planet.de Karsten Iwen - CCIE #14602 (Security, R/S) 8
the SNMPv3 security-model SNMP-Engines Groups Users Requirements IOS 12.0(3)T crypto-image for SNMP-priv http://security-planet.de Karsten Iwen - CCIE #14602 (Security, R/S) 9
configuring SNMPv3 SNMP-Engines Router#sh snmp engineid Local SNMP engineid: 800000090300C20007CF0000 Remote Engine ID IP-addr Port Router(config)#snmp-server engineid local 1234567890abcdef Router#sh snmp engineid Local SNMP engineid: 1234567890ABCDEF Remote Engine ID IP-addr Port http://security-planet.de Karsten Iwen - CCIE #14602 (Security, R/S) 10
configuring SNMPv3 SNMP-Groups Router#sh snmp group groupname: ILMI readview : *ilmi notifyview: <no notifyview specified> row status: active security model:v1 writeview: *ilmi groupname: ILMI readview : *ilmi notifyview: <no notifyview specified> row status: active security model:v2c writeview: *ilmi http://security-planet.de Karsten Iwen - CCIE #14602 (Security, R/S) 11
configuring SNMPv3 SNMP-Groups Router(config)#snmp-server group SecOps v3 priv access SNMP-ACL-SECOPS Router#sh run i snmp-server group snmp-server group SecOps v3 priv access SNMP-ACL-SECOPS Router#sh snmp group... groupname: SecOps security model:v3 priv readview : v1default writeview: <no writeview specified> notifyview: <no notifyview specified> row status: active access-list: SNMP-ACL-SECOPS http://security-planet.de Karsten Iwen - CCIE #14602 (Security, R/S) 12
configuring SNMPv3 SNMP-Users Router(config)#snmp-server user BOFH SecOps v3 auth sha PW1 priv des56 PW2 Router#sh run i snmp-server user Router# Router#sh snmp user User name: BOFH Engine ID: 1234567890ABCDEF storage-type: nonvolatile Authentication Protocol: SHA Privacy Protocol: DES Group-name: SecOps active http://security-planet.de Karsten Iwen - CCIE #14602 (Security, R/S) 13
configuring SNMPv3 sending notifications Router(config)#snmp-server host 10.10.10.11 traps version 3 auth BOFH? atm Allow SNMP atm traps cnpd Allow NBAR Protocol Discovery traps config Allow SNMP config traps... http://security-planet.de Karsten Iwen - CCIE #14602 (Security, R/S) 14
SNMP Misc. By default, the system can not be rebooted through snmp: Router(config)#snmp-server system-shutdown A manager can request to load or save the config from a tftp-server. That should be limited: Router(config)#snmp-server tftp-server-list? <1-99> IP standard access list WORD Access-list name Interface-descriptions are limited to 64 characters by default. Router(config)#snmp ifmib ifalias long http://security-planet.de Karsten Iwen - CCIE #14602 (Security, R/S) 15