Contents

Introduction

Prerequisites

Requirements

Components Used

Background Information

Configuration

Additional Configurations

Verify

Version 1

Version 2

Version 3

Troubleshoot Issues

Introduction

This document describes how to configure a Simple Network Management Protocol (SNMP) for the Network Services Orchestrator (NSO).

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:

- SNMP configuration loaded into NSO Configuration Database (CDB).

- Alarms generated on NSO.

- Command 'snmpwalk' support on the server.

Components Used

This document is not restricted to specific software and hardware versions.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

The configuration has been tested and validated on CentOS 7. On Ubuntu 18.04, the output is similar to the CentOS output, but the alarms are not generated.

In-built SNMP service provided by Linux can be stopped:

[root@nso-recreate ~]# service snmpd status

Redirectin to /bin/systemctl status snmpd.service

snmpd.service - Simple Network Management Protocol (SNMP) Daemon.

Loaded: loaded (/usr/lib/systemd/system/snmpd.service; disabled; vendor preset: disabled)

Active: inactive (dead)

Configuration

In the NSO CLI, go to Configuration mode and make these changes; the final SNMP configuration is:

admin@ncs# show running-config snmp

snmp agent enabled

snmp agent ip 0.0.0.0

snmp agent udp-port 4000

snmp agent version v1

snmp agent version v2c

snmp agent version v3

snmp agent engine-id enterprise-number 32473

snmp agent engine-id from-text testing

snmp agent max-message-size 50000

snmp system contact ""

snmp system name ""

snmp system location ""

snmp usm local user initial

auth sha password authpass

priv aes password privpass

!

snmp target monitor

ip 127.0.0.1

udp-port 162

tag [ monitor ]

timeout 1500

retries 3

v2c sec-name public

!

snmp community public

sec-name public

!

snmp notify foo

tag monitor

type trap

!

snmp vacm group initial

member initial

sec-model [ usm ]

!

access usm no-auth-no-priv

read-view internet

notify-view internet

!

access usm auth-no-priv

read-view internet

notify-view internet

!

access usm auth-priv

read-view internet

notify-view internet

!

!

snmp vacm group public

member public

sec-model [ v1 v2c ]

!

access any no-auth-no-priv

read-view internet

notify-view internet

!

!

snmp vacm view internet

subtree 1.3.6.1

included

!

!

snmp vacm view restricted

subtree 1.3.6.1.6.3.11.2.1

included

!

subtree 1.3.6.1.6.3.15.1.1

included

!

!

Additional Configurations

To validate whether SNMP works, you can create an alarm and verify the alarm with the show alarms alarm-list  command:

admin@ncs# show alarms alarm-list

alarms alarm-list number-of-alarms 2

alarms alarm-list last-changed 2022-03-31T09:26:58.912259+00:00

alarms alarm-list alarm ios0 connection-failure /devices/device[name='ios0'] ""

is-cleared false

last-status-change 2022-03-31T09:26:58.912259+00:00

last-perceived-severity major

last-alarm-text "Failed to connect to device ios0: connection refused: NEDCOM CONNECT: Connection refused (Connection refused) in new state"

status-change 2022-03-31T09:26:58.912259+00:00

received-time 2022-03-31T09:26:58.912259+00:00

perceived-severity major

alarm-text "Failed to connect to device ios0: connection refused: NEDCOM CONNECT: Connection refused (Connection refused) in new state"

alarms alarm-list alarm jun0 connection-failure /devices/device[name='jun0'] ""

is-cleared false

last-status-change 2022-03-31T09:26:57.507969+00:00

last-perceived-severity major

last-alarm-text "Failed to connect to device jun0: connection refused"

status-change 2022-03-31T09:26:57.507969+00:00

received-time 2022-03-31T09:26:57.507969+00:00

perceived-severity major

alarm-text "Failed to connect to device jun0: connection refused"

Verify

To verify that the configurations are correct, verify the different versions of SNMP:

Note: To get the entire output, you can use the OID .1.3.6.1. To get just the alarms, you can use 1.3.6.1.4.1.

Version 1

snmpwalk -v 1 -c public 0.0.0.0:4000 .1.3.6.1

snmpwalk -v 1 -c public 0.0.0.0:4000 .1.3.6.1.4.1

Version 2

snmpwalk -v 2c -c public 0.0.0.0:4000 .1.3.6.1

snmpwalk -v 2c -c public 0.0.0.0:4000 .1.3.6.1.4.1

Version 3

snmpwalk -On -v3 -a SHA -x AES -A 'authpass' -X 'privpass' -l 'authPriv' -u 'initial' 0.0.0.0:4000 .1.3.6.1

snmpwalk -On -v3 -a SHA -x AES -A 'authpass' -X 'privpass' -l 'authPriv' -u 'initial' 0.0.0.0:4000 .1.3.6.1.4.1

The expected output for the  snmpwalk command is:

[root@nso-recreate ~]# snmpwalk -On -v3 -a SHA -x AES -A 'authpass' -X 'privpass' -l 'authPriv' -u 'initial' 0.0.0.0:4000 .1.3.6.1.4.1

.1.3.6.1.4.1.24961.2.103.1.1.1.0 = Gauge32: 2

.1.3.6.1.4.1.24961.2.103.1.1.2.0 = Hex-STRING: 07 E6 03 1F 09 1A 3A 09 2B 00 00

.1.3.6.1.4.1.24961.2.103.1.1.5.1.2.1 = STRING: "connection-failure"

.1.3.6.1.4.1.24961.2.103.1.1.5.1.2.2 = STRING: "connection-failure"

.1.3.6.1.4.1.24961.2.103.1.1.5.1.3.1 = STRING: "jun0"

.1.3.6.1.4.1.24961.2.103.1.1.5.1.3.2 = STRING: "ios0"

.1.3.6.1.4.1.24961.2.103.1.1.5.1.4.1 = STRING: "/ncs:devices/ncs:device[ncs:name='jun0']"

.1.3.6.1.4.1.24961.2.103.1.1.5.1.4.2 = STRING: "/ncs:devices/ncs:device[ncs:name='ios0']"

.1.3.6.1.4.1.24961.2.103.1.1.5.1.5.1 = OID: .0.0

.1.3.6.1.4.1.24961.2.103.1.1.5.1.5.2 = OID: .0.0

.1.3.6.1.4.1.24961.2.103.1.1.5.1.6.1 = ""

.1.3.6.1.4.1.24961.2.103.1.1.5.1.6.2 = ""

.1.3.6.1.4.1.24961.2.103.1.1.5.1.7.1 = ""

.1.3.6.1.4.1.24961.2.103.1.1.5.1.7.2 = ""

.1.3.6.1.4.1.24961.2.103.1.1.5.1.8.1 = INTEGER: 2

.1.3.6.1.4.1.24961.2.103.1.1.5.1.8.2 = INTEGER: 2

.1.3.6.1.4.1.24961.2.103.1.1.5.1.9.1 = Gauge32: 0

.1.3.6.1.4.1.24961.2.103.1.1.5.1.9.2 = Gauge32: 0

.1.3.6.1.4.1.24961.2.103.1.1.5.1.10.1 = Hex-STRING: 07 E6 03 1F 09 1A 39 05 2B 00 00

.1.3.6.1.4.1.24961.2.103.1.1.5.1.10.2 = Hex-STRING: 07 E6 03 1F 09 1A 3A 09 2B 00 00

.1.3.6.1.4.1.24961.2.103.1.1.5.1.11.1 = Hex-STRING: 07 E6 03 1F 09 1A 39 05 2B 00 00

.1.3.6.1.4.1.24961.2.103.1.1.5.1.11.2 = Hex-STRING: 07 E6 03 1F 09 1A 3A 09 2B 00 00

.1.3.6.1.4.1.24961.2.103.1.1.5.1.12.1 = INTEGER: 4

.1.3.6.1.4.1.24961.2.103.1.1.5.1.12.2 = INTEGER: 4

.1.3.6.1.4.1.24961.2.103.1.1.5.1.13.1 = INTEGER: 2

.1.3.6.1.4.1.24961.2.103.1.1.5.1.13.2 = INTEGER: 2

.1.3.6.1.4.1.24961.2.103.1.1.5.1.14.1 = STRING: "Failed to connect to device jun0: connection refused"

.1.3.6.1.4.1.24961.2.103.1.1.5.1.14.2 = STRING: "Failed to connect to

device ios0: connection refused: NEDCOM CONNECT: Connection refused (Connection refused) in new state"

Troubleshoot Issues

Several known issues include:

- snmpwalk: Timeout

The timeout could happen because:

- NSO is down

- The IP/Port used in command is incorrect

- Unknown user name (Only v3)

The username associated is wrong/incorrect, the value after the "-u" parameter

- No Such Object available on this agent at this OID

The initial user is not assigned to any group. Add one of the options:

snmp usm local user admin

auth sha password ....

priv aes password ....

OR

nacm groups group ncsoper user-name [ public initial ]