Simple Network Management Protocol (SNMP) is an application-layer protocol that provides a message format for communication between SNMP managers and agents. SNMP provides a standardized framework and a common language used for the monitoring and management of devices in a network.

The SNMP framework has three parts:

• SNMP manager - The SNMP manager is used to control and monitor the activities of network hosts using SNMP.

• SNMP agent - The SNMP agent is the software component within the managed device that maintains the data for the device and reports these data, as needed, to managing systems.

• MIB - The Management Information Base (MIB) is a virtual information storage area for network management information, which consists of collections of managed objects.

A manager can send the agent requests to get and set MIB values. The agent can respond to these requests. Independent of this interaction, the agent can send unsolicited notifications (traps or informs) to the manager to notify the manager of network conditions.

Cisco enterprise NFVIS supports the following versions of SNMP:

• SNMP v1—The Simple Network Management Protocol: A Full Internet Standard, defined in RFC 1157. (RFC 1157 replaces the earlier versions that were published as RFC 1067 and RFC 1098.) Security is based on community strings.

• SNMP v2c—The community-string based Administrative Framework for SNMPv2. SNMPv2c (the "c" stands for "community") is an Experimental Internet Protocol defined in RFC 1901, RFC 1905, and RFC 1906. SNMPv2c is an update of the protocol operations and data types of SNMPv2p (SNMPv2 Classic), and uses the community-based security model of SNMPv1.

• SNMPv3—Version 3 of SNMP. SNMPv3 is an interoperable standards-based protocol defined in RFCs 3413 to 3415. SNMPv3 provides secure access to devices by authenticating and encrypting packets over the network.

Both SNMP v1 and SNMP v2c use a community-based form of security. The community of managers able to access the agent MIB is defined by an IP address Access Control List and password.

SNMPv3 is a security model in which an authentication strategy is set up for a user and the group in which the user resides. A security level is the permitted level of security within a security model. A combination of a security model and a security level determines which security mechanism is employed when handling an SNMP packet.

Authentication of the community with the user configuration is implemented even though SNMP v1 and v2 traditionally do not require a user configuration to be set. For both SNMP v1 and v2 on NFVIS, the user must be set with the same name and version as the corresponding community name. The user group must also match an existing group with the same SNMP version for snmpwalk commands to work.

The following MIB's are supported for SNMP on NFVIS:

IF-MIB:

• ifDescr

• ifType

• ifPhysAddress

• ifSpeed

• ifOperStatus

• ifAdminStatus

• ifMtu

• ifName

• ifHighSpeed

• ifPromiscuousMode

• ifConnectorPresent

• ifInErrors

• ifInDiscards

• ifInOctets

• ifOutErrors

• ifOutDiscards

• ifOutOctets

• ifOutUcastPkts

• ifHCInOctets

• ifHCInUcastPkts

• ifHCOutOctets

• ifHCOutUcastPkts

• ifInBroadcastPkts

• ifOutBroadcastPkts

• ifInMulticastPkts

• ifOutMulticastPkts

• ifHCInBroadcastPkts

• ifHCOutBroadcastPkts

• ifHCInMulticastPkts

• ifHCOutMulticastPkts

Entity MIB:

• entPhysicalIndex

• entPhysicalDescr

• entPhysicalVendorType

• entPhysicalContainedIn

• entPhysicalClass

• entPhysicalParentRelPos

• entPhysicalName

• entPhysicalHardwareRev

• entPhysicalFirmwareRev

• entPhysicalSoftwareRev

• entPhysicalSerialNum

• entPhysicalMfgName

• entPhysicalModelName

• entPhysicalAlias

• entPhysicalAssetID

• entPhysicalIsFRU

Cisco Process MIB:

• cpmCPUTotal1minRev

• cpmCPUTotal5minRev

• cpmCPUTotalIndex

• cpmCPUTotalPhysicalIndex

• cpmCPUMonInterval

• cpmCPUMemoryKernelReserved

• cpmCPUMemoryHCKernelReserved

• cpmCPUMemoryUsed

• cpmCPUMemoryFree

• cpmCPUMemoryHCUsed

• cpmCPUMemoryHCFree

• CISCO_ENVMON_MIB

• cpmProcessDynamicMemorySizeOvrflw

• cpmProcessType

• cpmCPULoadAvg1min

• cpmCPULoadAvg5min

• cpmCPULoadAvg15min

Though SNMP v1 and v2c is using community-based string, the following is still required:

• Same community and user name.

• Same SNMP version for user and group.

To configure SNMP v2 support:

configure terminal
snmp community public community-access readOnly

snmp group testgroup snmp 2 noAuthNoPriv read read-access write write-access notify notify-access

snmp user public user-group testgroup user-version 2

snmp host host2 host-ip-address 2.2.2.2 host-port 162 host-user-name public host-version 2 host-security-level noAuthNoPriv

snmp enable traps linkUp

To configure SNMP v3 support:

configure terminal
snmp group testgroup3 snmp 3 authPriv notify test write test read test
snmp user user3 user-version 3 user-group testgroup3 auth-protocol sha priv-protocol aes passphrase changePassphrase
! configure snmp host to enable snmp v3 trap
snmp host host3 host-ip-address 3.3.3.3 host-version 3 host-user-name user3 host-security-level authPriv host-port 162
!
! Change to different security level
!
snmp group testgroup4 snmp 3 authNoPriv notify test write test read test
snmp user user4 user-version 3 user-group testgroup4 auth-protocol md5 passphrase changePassphrase
! configure snmp host to enable snmp v3 trap
snmp host host4 host-ip-address 4.4.4.4 host-version 3 host-user-name user4 host-security-level authNoPriv host-port 162
!
!
snmp enable traps linkUp
snmp enable traps linkDown

Note	SNMP host configuration is supported for NFVIS 3.6.1 release. Host trap server configuration will be officially supported for NFVIS 3.7.1 release.

Note	SNMP v3 context snmp is added automatically when configured from the web portal. To use a different context value or empty context string, use NFVIS CLI or API for configuration. NFVIS SNMP v3 only supports single passphrase for both auth-protocol and priv-protocol.

Note	NFVIS 3.11.1 release enhances the special character support for passphrase. Now the following characters are supported: @#$-!&*

nfvis# show snmp agent 

snmp agent sysDescr "Cisco NFVIS "
snmp agent sysOID 1.3.6.1.4.1.9.12.3.1.3.1291

nfvis# show snmp traps

TRAP      TRAP      
NAME      STATE     
--------------------
linkDown  disabled  
linkUp    enabled

nfvis# show snmp stats

snmp stats sysUpTime    57351917
snmp stats sysServices  70
snmp stats sysORLastChange 0
snmp stats snmpInPkts   104
snmp stats snmpInBadVersions 0
snmp stats snmpInBadCommunityNames 0
snmp stats snmpInBadCommunityUses 0
snmp stats snmpInASNParseErrs 0
snmp stats snmpSilentDrops 0
snmp stats snmpProxyDrops 0

nfvis# show running-config snmp

snmp agent enabled true
snmp agent engineID 00:00:00:09:11:22:33:44:55:66:77:88
snmp enable traps linkUp
snmp community pub_comm
community-access readOnly
!
snmp community tachen
community-access readOnly
!
snmp group tachen snmp 2 noAuthNoPriv
read   test
write  test
notify test
!
snmp group testgroup snmp 2 noAuthNoPriv
read   read-access
write  write-access
notify notify-access
!
snmp user public
user-version  2
user-group    2
auth-protocol md5
priv-protocol des
!
snmp user tachen
user-version 2
user-group   tachen
!
snmp host host2
host-port           162
host-ip-address     2.2.2.2
host-version        2
host-security-level noAuthNoPriv
host-user-name      public
!