topic Re: Does ISE supports SNMPv3 Polling ? in Network Access Control

Does ISE supports SNMPv3 Polling ?

raghchan — Mon, 13 Nov 2017 07:54:48 GMT

I have checked in the documentation and SNMPv3 traps are supported. But is SNMPv3 Polling also supported ?

Re: Does ISE supports SNMPv3 Polling ?

paul — Mon, 13 Nov 2017 13:24:56 GMT

SNMPv3 polling is supported to network devices, but I don't believe it is supported to endpoints. For endpoint profiling I only see options to enter SNMP v2 community strings.

Re: Does ISE supports SNMPv3 Polling ?

hslai — Mon, 13 Nov 2017 14:59:46 GMT

To monitor ISE via SNMP, ISE 2.0 adds SNMPv3 support for both agents and traps. See CLI guide for configuration commands, such as snmp-server user

Below is an example of the configuration:

myISE/admin# configure

Enter configuration commands, one per line. End with CNTL/Z.

myISE/admin(config)# snmp-server host 1.1.1.1 ?

version SNMP version to use for notification messages

myISE/admin(config)# snmp-server host 1.1.1.1 version ?

1 Use SNMPv1

2c Use SNMPv2c

3 Use SNMPv3

myISE/admin(config)# snmp-server host 1.1.1.1 version 3 ?

<WORD> Remote UserName (Max Size - 31)

myISE/admin(config)# snmp-server host 1.1.1.1 version 3 username ?

<WORD> Remote EngineID (Max Size - 40)

myISE/admin(config)# snmp-server host 1.1.1.1 version 3 username 0x80001f8880aa72ce403792785600000000 ?

hash Hash Passwords

plain Plain Passwords

myISE/admin(config)# snmp-server host 1.1.1.1 version 3 username 0x80001f8880aa72ce403792785600000000 plain ?

<WORD> Auth Password (Max Size - 40)

myISE/admin(config)# snmp-server host 1.1.1.1 version 3 username 0x80001f8880aa72ce403792785600000000 plain lab123123 ?

<WORD> Priv Password (Max Size - 40)

myISE/admin(config)# snmp-server host 1.1.1.1 version 3 username 0x80001f8880aa72ce403792785600000000 plain lab123123 lab123123

myISE/admin(config)# snmp-server host 1.1.1.1 version 3 testuser 0x80001f8880aa72ce403792785600000000 plain lab123123 lab123123

myISE/admin(config)# snmp-server user usertestname v3 plain lab123123 lab123123

myISE/admin# sh run | inc snmp

snmp-server enable

snmp-server host 1.1.1.1 version 3 testuser 0x80001f8880aa72ce403792785600000000 hash 20A4FEA5635C18EBD115CF8884EBDC99717FAB14 20A4FEA5635C18EBD115CF8884EBDC99

snmp-server engineID OFPEIMID9J1

snmp-server user usertestname v3 hash 0xcddaf9a603a1f5af20d3b5cfda37e31a134b4a09 0xcddaf9a603a1f5af20d3b5cfda37e31a

Re: Does ISE supports SNMPv3 Polling ?

Parag Mahajan — Mon, 13 Nov 2017 20:52:43 GMT

FYI -- Below defect resolved in 2.2P3 if you are planning to use AES256 for SNMPv3

CSCvd03239 SNMPv3 with AES256 encryption for SNMP profiling probe does not work in ISE 1.1.x/1.x/2.x.

Re: Does ISE supports SNMPv3 Polling ?

penncro1 — Thu, 12 Apr 2018 20:16:51 GMT

Has anyone been able to use ISE 2.3 to poll NADs (such as Cisco 2960S and 3560 switches) using SNMPv3? I have upgraded to the suggested IOS software in the switches. I believe my configs are correct as using the Paessler SNMP Tester was able to get information back. I have read about the AES256 issue but have only used AES128 encryption. How does ISE use the polled information on the NADs? Where is it recorded?

Re: Does ISE supports SNMPv3 Polling ?

paul — Thu, 12 Apr 2018 21:01:24 GMT

I spent quite a bit of time trying to get it to work correctly at a customer. The customer also spent a fair amount of time trying to get it to work. We never could get it to work and punted to V2 read-only community string with ACL restrictions.

Re: Does ISE supports SNMPv3 Polling ?

penncro1 — Thu, 12 Apr 2018 21:07:25 GMT

Thanks for your input as I’m starting to think there is still a bug in this ISE 2.3 release.

I spent a lot of time also on this but have not been able to get it working. It comes back with:

SNMP request times out, or SNMP community/user auth data is incorrect.

I hope we hear from a Cisco TAC on this issue.

Re: Does ISE supports SNMPv3 Polling ?

Jason Kunst — Thu, 12 Apr 2018 21:17:02 GMT

This is not Cisco TAC if you’re needing support please reach out to them to troubleshoot and open bugs

Re: Does ISE supports SNMPv3 Polling ?

hslai — Fri, 13 Apr 2018 03:43:59 GMT

Henry's inquiry is actually not related to what asked in the original question, which is about how to use SNMPv3 to monitor ISE.

penncro1: In the future, please start your own thread. If you post your TAC case number and if time permits, I can take a quick look. If not already done, please try using some SNMP tool (e.g. snmpwalk or snmpget from Net-SNMP) to verify the SNMP configuration on your NADs.

Re: Does ISE supports SNMPv3 Polling ?

penncro1 — Fri, 13 Apr 2018 13:25:12 GMT

Thanks for all the feedback. Sorry about posting the wrong thread but thought it was all related to SNMPv3 on ISE. I did open a case with TAC (684244782) but have not hear back regarding the ability for ISE 2.3 to poll NADs using SNMPv3. Have used snmp test software and verified that the config on the NAD is correct. In addition, I also have Prime Infrastructure that is polling these devices using SNMPv3.

Re: Does ISE supports SNMPv3 Polling ?

hslai — Sun, 15 Apr 2018 19:29:16 GMT

The assigned TAC engineer is currently out of office but he did notify you and provided you an alternative contact.

Meanwhile, I would suggest to turn DEBUG on profiler and also on the switch. Check profiler.log while recreating the issue and provide the debug log file to TAC. Also, it seems possible to perform a wired capture the SNMP exchanges and decode it using WireShark. There are some instructions on the net for that so I would suggest you to try that, as well, to understand better what might have gone wrong.

Re: Does ISE supports SNMPv3 Polling ?

hslai — Sun, 15 Apr 2018 19:35:11 GMT

See also chyps's comment for Re: ISE - Test SNMP Access to a Node