Configure SNMP for the Network Services Orchestrator 5.5.3.1

Available Languages

Download Options

  • PDF     (45.6 KB)
    View with Adobe Reader on a variety of devices
  • ePub     (84.2 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (71.1 KB)
    View on Kindle device or Kindle app on multiple devices
Updated:August 31, 2022
Document ID:218119

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

    Introduction

    This document describes how to configure a Simple Network Management Protocol (SNMP) for the Network Services Orchestrator (NSO).

    Prerequisites

    Requirements

    Cisco recommends that you have knowledge of these topics:

    • SNMP configuration loaded into NSO Configuration Database (CDB).
    • Alarms generated on NSO.
    • Command 'snmpwalk' support on the server.

    Components Used

    This document is not restricted to specific software and hardware versions.

    The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

    Background Information

    The configuration has been tested and validated on CentOS 7. On Ubuntu 18.04, the output is similar to the CentOS output, but the alarms are not generated.

    In-built SNMP service provided by Linux can be stopped:

    [root@nso-recreate ~]# service snmpd status 

    Redirectin to /bin/systemctl status snmpd.service

    snmpd.service - Simple Network Management Protocol (SNMP) Daemon.

    Loaded: loaded (/usr/lib/systemd/system/snmpd.service; disabled; vendor preset: disabled)

    Active: inactive (dead)

    Configuration

    In the NSO CLI, go to Configuration mode and make these changes; the final SNMP configuration is:

    admin@ncs# show running-config snmp
    snmp agent enabled
    snmp agent ip 0.0.0.0
    snmp agent udp-port 4000
    snmp agent version v1
    snmp agent version v2c
    snmp agent version v3
    snmp agent engine-id enterprise-number 32473
    snmp agent engine-id from-text testing
    snmp agent max-message-size 50000
    snmp system contact ""
    snmp system name ""
    snmp system location ""
    snmp usm local user initial
    auth sha password authpass
    priv aes password privpass
    !
    snmp target monitor
    ip 127.0.0.1
    udp-port 162
    tag [ monitor ]
    timeout 1500
    retries 3
    v2c sec-name public
    !
    snmp community public
    sec-name public
    !
    snmp notify foo
    tag monitor
    type trap
    !
    snmp vacm group initial
    member initial
    sec-model [ usm ]
    !
    access usm no-auth-no-priv
    read-view internet
    notify-view internet
    !
    access usm auth-no-priv
    read-view internet
    notify-view internet
    !
    access usm auth-priv
    read-view internet
    notify-view internet
    !
    !
    snmp vacm group public
    member public
    sec-model [ v1 v2c ]
    !
    access any no-auth-no-priv
    read-view internet
    notify-view internet
    !
    !
    snmp vacm view internet
    subtree 1.3.6.1
    included
    !
    !
    snmp vacm view restricted
    subtree 1.3.6.1.6.3.11.2.1
    included
    !
    subtree 1.3.6.1.6.3.15.1.1
    included
    !
    !

    Additional Configurations

    To validate whether SNMP works, you can create an alarm and verify the alarm with the show alarms alarm-list  command:

    admin@ncs# show alarms alarm-list
    alarms alarm-list number-of-alarms 2
    alarms alarm-list last-changed 2022-03-31T09:26:58.912259+00:00
    alarms alarm-list alarm ios0 connection-failure /devices/device[name='ios0'] ""
    is-cleared false
    last-status-change 2022-03-31T09:26:58.912259+00:00
    last-perceived-severity major
    last-alarm-text "Failed to connect to device ios0: connection refused: NEDCOM CONNECT: Connection refused (Connection refused) in new state" 
    status-change 2022-03-31T09:26:58.912259+00:00
    received-time 2022-03-31T09:26:58.912259+00:00
    perceived-severity major
    alarm-text "Failed to connect to device ios0: connection refused: NEDCOM CONNECT: Connection refused (Connection refused) in new state" 
    alarms alarm-list alarm jun0 connection-failure /devices/device[name='jun0'] ""
    is-cleared false
    last-status-change 2022-03-31T09:26:57.507969+00:00
    last-perceived-severity major
    last-alarm-text "Failed to connect to device jun0: connection refused" 
    status-change 2022-03-31T09:26:57.507969+00:00
    received-time 2022-03-31T09:26:57.507969+00:00
    perceived-severity major
    alarm-text "Failed to connect to device jun0: connection refused" 

    Verify

    To verify that the configurations are correct, verify the different versions of SNMP:

    Note: To get the entire output, you can use the OID .1.3.6.1. To get just the alarms, you can use 1.3.6.1.4.1.

    Version 1

    snmpwalk -v 1 -c public 0.0.0.0:4000 .1.3.6.1

    snmpwalk -v 1 -c public 0.0.0.0:4000 .1.3.6.1.4.1

    Version 2

    snmpwalk -v 2c -c public 0.0.0.0:4000 .1.3.6.1
    snmpwalk -v 2c -c public 0.0.0.0:4000 .1.3.6.1.4.1

    Version 3

    snmpwalk -On -v3 -a SHA -x AES -A 'authpass' -X 'privpass' -l 'authPriv' -u 'initial' 0.0.0.0:4000 .1.3.6.1

    snmpwalk -On -v3 -a SHA -x AES -A 'authpass' -X 'privpass' -l 'authPriv' -u 'initial' 0.0.0.0:4000 .1.3.6.1.4.1

    The expected output for the snmpwalk command is:

    [root@nso-recreate ~]# snmpwalk -On -v3 -a SHA -x AES -A 'authpass' -X 'privpass' -l 'authPriv' -u 'initial' 0.0.0.0:4000 .1.3.6.1.4.1
    .1.3.6.1.4.1.24961.2.103.1.1.1.0 = Gauge32: 2
    .1.3.6.1.4.1.24961.2.103.1.1.2.0 = Hex-STRING: 07 E6 03 1F 09 1A 3A 09 2B 00 00
    .1.3.6.1.4.1.24961.2.103.1.1.5.1.2.1 = STRING: "connection-failure"
    .1.3.6.1.4.1.24961.2.103.1.1.5.1.2.2 = STRING: "connection-failure"
    .1.3.6.1.4.1.24961.2.103.1.1.5.1.3.1 = STRING: "jun0"
    .1.3.6.1.4.1.24961.2.103.1.1.5.1.3.2 = STRING: "ios0"
    .1.3.6.1.4.1.24961.2.103.1.1.5.1.4.1 = STRING: "/ncs:devices/ncs:device[ncs:name='jun0']"
    .1.3.6.1.4.1.24961.2.103.1.1.5.1.4.2 = STRING: "/ncs:devices/ncs:device[ncs:name='ios0']"
    .1.3.6.1.4.1.24961.2.103.1.1.5.1.5.1 = OID: .0.0
    .1.3.6.1.4.1.24961.2.103.1.1.5.1.5.2 = OID: .0.0
    .1.3.6.1.4.1.24961.2.103.1.1.5.1.6.1 = ""
    .1.3.6.1.4.1.24961.2.103.1.1.5.1.6.2 = ""
    .1.3.6.1.4.1.24961.2.103.1.1.5.1.7.1 = ""
    .1.3.6.1.4.1.24961.2.103.1.1.5.1.7.2 = ""
    .1.3.6.1.4.1.24961.2.103.1.1.5.1.8.1 = INTEGER: 2
    .1.3.6.1.4.1.24961.2.103.1.1.5.1.8.2 = INTEGER: 2
    .1.3.6.1.4.1.24961.2.103.1.1.5.1.9.1 = Gauge32: 0
    .1.3.6.1.4.1.24961.2.103.1.1.5.1.9.2 = Gauge32: 0
    .1.3.6.1.4.1.24961.2.103.1.1.5.1.10.1 = Hex-STRING: 07 E6 03 1F 09 1A 39 05 2B 00 00
    .1.3.6.1.4.1.24961.2.103.1.1.5.1.10.2 = Hex-STRING: 07 E6 03 1F 09 1A 3A 09 2B 00 00
    .1.3.6.1.4.1.24961.2.103.1.1.5.1.11.1 = Hex-STRING: 07 E6 03 1F 09 1A 39 05 2B 00 00
    .1.3.6.1.4.1.24961.2.103.1.1.5.1.11.2 = Hex-STRING: 07 E6 03 1F 09 1A 3A 09 2B 00 00
    .1.3.6.1.4.1.24961.2.103.1.1.5.1.12.1 = INTEGER: 4
    .1.3.6.1.4.1.24961.2.103.1.1.5.1.12.2 = INTEGER: 4
    .1.3.6.1.4.1.24961.2.103.1.1.5.1.13.1 = INTEGER: 2
    .1.3.6.1.4.1.24961.2.103.1.1.5.1.13.2 = INTEGER: 2
    .1.3.6.1.4.1.24961.2.103.1.1.5.1.14.1 = STRING: "Failed to connect to device jun0: connection refused" 
    .1.3.6.1.4.1.24961.2.103.1.1.5.1.14.2 = STRING: "Failed to connect to 
    device ios0: connection refused: NEDCOM CONNECT: Connection refused (Connection refused) in new state" 

    Troubleshoot Issues

    Several known issues include: 

    • snmpwalk: Timeout

    The timeout could happen because:

    - NSO is down

    - The IP/Port used in command is incorrect

    • Unknown user name (Only v3)

    The username associated is wrong/incorrect, the value after the "-u" parameter

    • No Such Object available on this agent at this OID

    The initial user is not assigned to any group. Add one of the options:

    snmp usm local user admin

      auth sha password ....

      priv aes password ....

    OR

    nacm groups group ncsoper user-name [ public initial ]

    Revision History

    Revision Publish Date Comments
    1.0
    31-Aug-2022
    Initial Release
    TAC Authored

    Contributed by Cisco Engineers

    • Narayan T
      Cisco Software Consulting Engineer

    Was this Document Helpful?

    FeedbackFeedback

    Contact Cisco