- [Instructor] SNMP version three
is the latest iteration of SNMP,
and it's also the recommended version whenever possible.
SNMP version three added confidentiality
through the encryption of packets
and also message integrity
by ensuring that the information was received
from a reliable source.
Although the function
is fundamentally the same as version two,
there are some specific differences that you'll see
in our configuration output.
And these are going to be important to look over
when troubleshooting.
Let's say show run pipe to section SNMP,
and we'll take a look at my SNMP version three configuration
that's in place.
So this might look a little more daunting,
but let's take it line by line.
And the first thing you'll notice
is that we have SNMP server groups,
we have a server view,
and we're also going to have server users defined.
Essentially the structure here
is that we have an SNMP group defined
and we have SNMP users mapped into that group.
Each user is also mapped into an SNMP view,
which controls what they're able to see.
We can run show commands for each of those three structures
to dig a little deeper,
so let's actually do that.
Let's say show snmp group.
And if we go down to the bottom,
we see our SNMP group named READONLY
which we previously saw in the output we already looked at.
And the places to look when troubleshooting here
are first the read view section.
You can see that the read view here
says that we're attached to a view named UPTIME.
We'll examine this view in just a second,
but what is happening here is that
any user associated with the READONLY group
that we've defined
is only going to be able to view information
that is identified
by the configured view named UPTIME.
So the nesting of our groups, our users, and our views,
that's a critical piece
of SNMP version three troubleshooting.
When you have groups, views and users configured,
we need to check all of this nesting
and make sure that everything is associated together
with the correct entities.
Also notice that we see an access list identified,
access list 10 in this case.
So this means that only servers permitted by access list 10
would be allowed to read the information
found in the UPTIME view.
So that's another place you'll want to look for issues.
We would want to do a show access list command,
and make sure that we have correctly identified
our host systems
inside the access control list.
We can also see our security model
listed within this output,
which is SNMP version three priv.
Within SNMP, we have three security levels.
Those are no auth no priv, auth no priv, and auth priv.
You may recall these from ENCOR or other CCNP training.
And these allow you to choose
which security features of SNMP that you have in place.
In this case, we see the priv key word.
And that means within iOS,
this has enabled the full security suite of auth priv.
So we have both authentication and encryption in place.
Now, whatever level you choose,
you want to make sure that you're consistent with that
across your configuration.
Whatever you're configuring as the security level
for the group, for the users and for the sending of traps,
you want those all to match
what you have configured on the server.
So the next thing,
let's say show snmp user.
In this output, we can see our configured username,
which is SNMPSERVER.
We can also see that this is assigned to the group READONLY.
Recall that we just looked at the READONLY group up here.
So this user is in fact attached
to that group that we would want to see.
So, again, double checking
this kind of nesting and assignment
when troubleshooting is really important.
We can also see our authentication
and privacy protocols listed here.
We see authentication is using SHA
and the privacy protocol is AES256.
So obviously we want those to be correct.
And we also want our passwords to match.
If we go back to our original show output,
and I'll just run that again
rather than trying to scroll up.
So if we take a look at that again,
we can see right here that our community string
is set to ENARSI in all caps.
And we can see some of the same security parameters
listed in our show snmp user output.
So if that isn't a valid password
that's configured on our server,
that's a problem.
But we also want to make sure
that the hashing and encryption algorithms
are defined correctly
across all of our platforms.
If you're getting an authentication failure from the server,
that means that either your hashing algorithm
or your password doesn't match.
For this user, we see that SHA is being used
as the hashing algorithm,
along with the ENARSI password that we looked at.
So if you can authenticate correctly,
but you're having trouble viewing the received data,
then that indicates there's possibly
an issue with the encryption algorithm,
maybe that doesn't match.
We see here that's AES256 being used
as the encryption algorithm.
So again, all of these parameters
need to match on both sides
for this to work properly.
Let's also say show snmp view.
And this is going to be a really long output.
And I'm going to scroll up to the top
because that's going to show some of our
newly configured views that we have
rather than these default views.
And this is the one that we want to take a look at.
You can see that we have a view named UPTIME,
which is already been shown
in some of our previous show commands.
And we can also see the command output for sysUpTime.
The sysUpTime keyword is an OID, an object identifier.
And this is the way that Cisco devices locate
and identify specific information.
And so that's a way that within a view,
we can only allow very specific information to be accessed,
which in this case would be the system uptime.
If you see some lines that end with included,
let me actually go down and do another show run command,
we'll look at that SNMP again.
And you can see in this output,
this is the line that we see in our view.
The view is named UPTIME,
we have the system uptime identified
and we have the included keyword.
So if you have multiple lines
that end with included as we see here,
that means that only these OIDs would be read.
So in this case, only the system uptime would be read.
If this is not specified at all,
then everything's going to be read.
Now you can also use the excluded keyword
rather than the included keyword.
And that's going to give access to everything
except for whatever you say is being excluded.
But by default,
if you don't set up a custom view,
everything is going to be allowed.
One last command that we'll look at,
we'll say show snmp host.
And here we can see information
about the server that we've identified.
We would again want to check the IP address,
we want to check that
against any access control lists that we have,
and we can see the port that's being used,
which is UDP port 162.
So if for some reason you've configured the wrong port,
that will obviously be an issue,
that's a place you'll want to look.
We can see the specific type is set to trap here as well,
we can see the user is SNMP server,
so again we're looking at that nesting,
looking at those associations,
and we can once again see the security model,
which is SNMP version three,
and it's using priv for the full protection suite.
All of those options are obviously
a little more involved than SNMP version two,
but that's because this is a more robust protocol
with the added protection found in version three.
So that's a look at troubleshooting SNMP version three.