topic Re: In the ASA configuration in Network Security

Viewing SNMP communities on ASA

jedavis — Tue, 12 Mar 2019 07:23:23 GMT

Is there any way to retrieve the configured SNMP communities from an ASA now that this information has been obfuscated in system:running-config?

-Jeff

Hi,

Aditya Ganjoo — Tue, 23 Feb 2016 15:28:10 GMT

Hi,

So do we want to know what communities have been configured on the ASA ?

Have we removed them ?

Regards,

Aditya

In the ASA configuration

jedavis — Wed, 02 Mar 2016 20:31:37 GMT

In the ASA configuration displays SNMP communities are obfuscated, like this:

ASA# show conf | i community
snmp-server host outside NMS-SERVER community *****
snmp-server community *****

As near back as 9.2 you could still display those communities using this command:

ASA# more system:running-config | i community
snmp-server host outside NMS-SERVER community public
snmp-server community public

I do not know when it changed, but in version 9.4 the more system:running-config command now also obfuscates the SNMP communites. In version 9.4 is there any way to recover these community strings?

Release notes do not show any

Pulkit Saxena — Thu, 03 Mar 2016 12:37:53 GMT

Release notes do not show any change in behavior on 9.4.

However, I feel it depends on the "snmp-server community" command.

Please check :

http://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/S/cmdref3/s15.html#pgfId-1559085

And confirm if you have used :

snmp-server community 0 cisco

snmp-server community 8 cisco

Since, as per command reference, it is clearly written :

"After you have used an encrypted community string, only the encrypted form is visible to all systems (for example, CLI, ASDM, CSM, and so on). The clear text password is not visible."

Regards,

Pulkit Saxena

Re: Viewing SNMP communities on ASA

Encl_Admn001 — Thu, 07 Jun 2018 20:09:52 GMT

Was searching for the same info and came across this thread.

I am on 9.1(7)23.

I knew it was possible because I had done it before.

I finally remembered the command sequence:

more system:running-config | i community

Re: Viewing SNMP communities on ASA

Abdullo Salikhov — Thu, 21 Jun 2018 14:53:28 GMT

another way is to make a backup of ASA from ASDM, extract files from archive and all passwords, keys and other hided text are in blank mode

Re: Release notes do not show any

nate_newman — Wed, 26 Sep 2018 16:49:19 GMT

This doesn't work in multi-context mode:

plccdtfw/sec/act# more disk0:/plcfw2.cfg | i community
snmp-server host outside 10.18.58.232 community ***** version 2c
snmp-server host outside 10.16.47.244 community ***** version 2c
snmp-server host outside 10.16.16.91 community ***** version 2c

Re: In the ASA configuration

Luis Piacesi — Sat, 09 Mar 2019 08:39:04 GMT

For ASA 9.4 version, do:

FW-ASA-01/act# more disk0:/ASA.cfg | i community
snmp-server host MGMT-NOC 192.168.10.100 community P@$$w0rd version 2c udp-port 161
snmp-server community P@$$w0rd

You must ensure that you're in system context.

PS: After type "more disk0:" put the "/" and type "?" to show all context configuration files

Best Regards,

Luis Claudio Bruno Piacesi

Re: In the ASA configuration

Maestro — Wed, 03 Apr 2019 12:05:05 GMT

excellent answer @jedavis

this command should

more system:running-config | i community

Re: In the ASA configuration

nate_newman — Wed, 03 Apr 2019 15:12:04 GMT

more system:running-config | i community

Does not work in multi-context. Try it on an actual firewall, don't just depend on the admin guide.

Re: In the ASA configuration

Maestro — Wed, 03 Apr 2019 15:55:01 GMT

changeto management

changeto system

then try the command

more system:running-config | i community

Re: In the ASA configuration

nate_newman — Wed, 03 Apr 2019 16:32:50 GMT

Maestro,

The community strings are defined within each context, not in the system context. Because each context is its own totally separate virtual firewall they are monitored directly via snmp not through the system context, it doesn't work that way.

Within the context itself the command doesn't work.

#changeto context fw-1

CORFW/pri/act/fw-1# more system:running-config | i community
^
ERROR: % Invalid input detected at '^' marker

Re: In the ASA configuration

Maestro — Wed, 03 Apr 2019 17:37:50 GMT

in your case you need the following commands

#changeto context fw-1

CORFW/pri/act/fw-1# show snmp-server group

let me know, this should show your community strings/key

Re: In the ASA configuration

nate_newman — Wed, 03 Apr 2019 19:58:03 GMT

That worked, thank you!

Re: In the ASA configuration

shurufade — Wed, 03 Apr 2019 22:07:29 GMT

It worked for me, thank you Maestro

Re: In the ASA configuration

jedavis — Mon, 01 Jul 2019 18:05:07 GMT

Thanks Maestro. I was unaware of that command. This solution works in single context as well as multi-context

Re: In the ASA configuration

goodluckyz — Fri, 18 Oct 2019 08:30:34 GMT

That works!

Re: In the ASA configuration

mg.dev@tcs.com — Wed, 06 Oct 2021 09:40:02 GMT

Works .! Thanks