topic Re: Configure SNMP in firepower 1xxx series with FDM in Network Security

Configure SNMP in firepower 1xxx series with FDM

a118123 — Mon, 20 Nov 2023 10:45:20 GMT

I am trying to configure SNMP in firepower 1xxx series (1010) with FDM.

Firmware is 7.3.1

According to this similar guide, I enter some command.

https://www.cisco.com/c/zh_tw/support/docs/ip/simple-network-management-protocol-snmp/213971-configure-snmp-on-firepower-ngfw-applian.html

ksec-fpr9k-1-A# scope monitoring
ksec-fpr9k-1-A /monitoring # enable snmp
ksec-fpr9k-1-A /monitoring* # set snmp community
Enter a snmp community:
ksec-fpr9k-1-A /monitoring* # enter snmp-trap 192.168.10.100
ksec-fpr9k-1-A /monitoring/snmp-trap* # set community
Community:
ksec-fpr9k-1-A /monitoring/snmp-trap* # set version v2c
ksec-fpr9k-1-A /monitoring/snmp-trap* # set notificationtype traps
ksec-fpr9k-1-A /monitoring/snmp-trap* # set port 162
ksec-fpr9k-1-A /monitoring/snmp-trap* # exit
ksec-fpr9k-1-A /monitoring* # commit-buffer

When I type commit-buffer, it does not let me save, what's going wrong?

Re: Configure SNMP in firepower 1xxx series with FDM

MHM Cisco World — Mon, 20 Nov 2023 10:49:20 GMT

Snmp must config via fdm or fmc not via cli.

The only 4000 and 9000 can config via cli.

Check guide it talk about 4000 and 9000 not 1000.

Re: Configure SNMP in firepower 1xxx series with FDM

MHM Cisco World — Mon, 20 Nov 2023 10:57:59 GMT

@MHM Cisco World wrote:

Snmp must config via fdm or fmc not via cli.

The only 4000 and 9000 can config via cli.

Check guide it talk about 4000 and 9000 not 1000.

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/710/management-center-device-config-71/interfaces-settings-snmp.html

https://community.cisco.com/t5/security-knowledge-base/how-to-enable-snmp-on-firepower-using-fdm/ta-p/4048084

Re: Configure SNMP in firepower 1xxx series with FDM

Rob Ingram — Mon, 20 Nov 2023 10:54:09 GMT

@a118123 you have to configure SNMP using Flexconfig when using FDM, even on the latest version 7.3. Here is a guide - https://community.cisco.com/t5/security-knowledge-base/how-to-enable-snmp-on-firepower-using-fdm/ta-p/4048084

Re: Configure SNMP in firepower 1xxx series with FDM

a118123 — Mon, 20 Nov 2023 14:18:58 GMT

Thanks for shared guide. But anyone know what is this error mean?

Re: Configure SNMP in firepower 1xxx series with FDM

Rob Ingram — Mon, 20 Nov 2023 14:26:45 GMT

@a118123 actually it looks like that won't work on newer FTD versions, try this - https://community.cisco.com/t5/security-knowledge-base/cisco-secure-firewall-device-manager-snmp-configuration-using/tac-p/4290136#M7147

Re: Configure SNMP in firepower 1xxx series with FDM

MHM Cisco World — Mon, 20 Nov 2023 14:32:25 GMT

You need to specify ver. of snmp in host command.

Please do double check the guide I and @Rob Ingram share.

Re: Configure SNMP in firepower 1xxx series with FDM

Marvin Rhoads — Mon, 20 Nov 2023 15:16:26 GMT

SNMP configuration is not possible using FDM GUI in version 6.7 through at least 7.4.1. You must instead use the API.

You can try using the API explorer (accessible via the FDM GUI from the 3 dots in the top right) or use the python script made available in this thread:

https://community.cisco.com/t5/security-knowledge-base/cisco-secure-firewall-device-manager-snmp-configuration-using/tac-p/4931861

Re: Configure SNMP in firepower 1xxx series with FDM

a118123 — Thu, 23 Nov 2023 04:59:12 GMT

Good idea sharing. So I can conclude that

scope monitoring
Flexobject

are not the way I am looking for, and API explorer (or using python script to call API) is the way I need for configurating SNMP.

Thanks.