topic ISE - Test SNMP Access to a Node in Network Access Control

ISE - Test SNMP Access to a Node

DamianRC — Tue, 03 Apr 2018 12:58:22 GMT

Hello,

I have a switch that should be SNMP polled by ISE.

Admin access to the switch is controlled by ISE.

The SNMP v3 settings have been applied in the "SNMP Settings" section.

Where can you view if ISE is able to access the switch?

Re: ISE - Test SNMP Access to a Node

paul — Tue, 03 Apr 2018 13:41:58 GMT

Set the SNMP poll time to the minimum of 10 minutes and watch for Profiler SNMP failure alarms on the home screen. That will tell you if SNMP to the NAD is working. I have never been able to get SNMPv3 working correctly from ISE to a switch. I usually just punt and tell the customer to setup an SNMPv2 read-only community string.

Re: ISE - Test SNMP Access to a Node

DamianRC — Tue, 03 Apr 2018 13:53:54 GMT

Thanks for this, sir.

Re: ISE - Test SNMP Access to a Node

Craig Hyps — Tue, 03 Apr 2018 14:34:43 GMT

From Live Log you can click the link presented for the switch port and this will trigger a report using SNMP (and indicate if SNMP successful). You can also go to Context Visibility and select Network Devices. Select the NAD of interest in table and select menu option to "Run on Selected" (under "Port Config Status").

To get SNMP probe working correctly with SNMPv3, it is necessary to configure the views and context to allow retrieval of the Bridge MIB and per-VLAN table data queried on triggered SNMP. As I recall, polled mode will not query these tables and should work with simpler config. Here is my working config for ISE SNMP Probe with SNMPv3:

snmp-server group snmpv3group v3 auth read iseview write iseview notify iseview

snmp-server group snmpv3group v3 auth context vlan- match prefix read iseview

snmp-server view iseview iso included

snmp-server trap-source GigabitEthernet1/0/24

snmp-server enable traps snmp linkdown linkup

snmp-server enable traps mac-notification change move

snmp-server host 10.1.100.8 version 3 auth snmpv3user mac-notification snmp

snmp-server user snmpv3user snmpv3group v3 auth md5 snmpv3pass

Of course you will need to make sure the ISE NAD config matches the username and password credentials configured on switch.

/Craig

Re: ISE - Test SNMP Access to a Node

DamianRC — Tue, 10 Apr 2018 12:16:49 GMT

Fantastic stuff!

Thank you.

Re: ISE - Test SNMP Access to a Node

Tymofii Dmytrenko — Sun, 07 Apr 2019 11:44:38 GMT

This is the only place where a valid SNMPv3 Traps config is given. Wasn't able to find this anywhere else.

Thanks Craig.

It's pity you left Cisco 🙂