topic Re: SNMP Configration for FPR-2130 Through FMC GUI in Network Security

SNMP Configration for FPR-2130 Through FMC GUI

netbeginner — Fri, 21 Feb 2020 17:53:55 GMT

Hi Experts,

We are configuring SNMP on our Firepower-2130 from Firepower management Center(FMC) GUI for Integration with NMS tool.

--> Configured SNMP receiver (i.e. NMS Server IP) , SNMP Version : 2 , TRAPs, Assigned a Interface as well.

All details are accepted and showing properly on GUI.

But while checking and verifying the configuration on Firepower CLI, i can't find any SNMP configuration which was configured there on FMC GUI. on CLI there is nothing about snmp-server.

Don't understand what & where i missed.

Please advise.

Re: SNMP Configration for FPR-2130 Through FMC GUI

Francesco Molino — Thu, 06 Feb 2020 04:19:12 GMT

Hi

Did you configure snmp on a platform policy? If so, is that platform policy assigned to the right device?

Re: SNMP Configration for FPR-2130 Through FMC GUI

netbeginner — Thu, 06 Feb 2020 04:50:23 GMT

Hi Francesco,

Ys , platform policy has been configured on FMC GUI. Further

Could u help & share how to chk this whether this is assigned to correct intended device or not.

And one point I forget to mention that problem is with snmp config only, rest all changes like policy etc which we are pushing from FMC is visible in FTD CLI.

Re: SNMP Configration for FPR-2130 Through FMC GUI

netbeginner — Thu, 06 Feb 2020 06:24:31 GMT

Hi Francesco,

Checked , FTD(FPR-2130) is already there added under the policy in FMC. After then only , we are entering for SNMP configuration.

problem is whatever we are pushing related to SNMP (Device -> platform setting -> policy -> FTD->SNMP) there is nothing replication or visbile on the FTD CLI.

However for rest of the configuration changes eg. security policy from FMC GUI, I can see them all in FPR-2130 CLI as well.

Please suggest.

Re: SNMP Configration for FPR-2130 Through FMC GUI

Francesco Molino — Thu, 06 Feb 2020 14:29:26 GMT

What version of FMC are you running?
Can you share screenshots to see how it is configured in FMC?
I can assure you that SNMP should be configured on this menu and it should be visible on FTD.
Can you share output of the following command in FTD from the CLISH prompt:
show running-config snmp-server

Re: SNMP Configration for FPR-2130 Through FMC GUI

netbeginner — Fri, 07 Feb 2020 08:27:08 GMT

Hi Francesco,

Please find the FPR version : Version 6.4.0.7 (Build 53) - [Cisco Firepower 2130]

Output for sh run snmp-server

firepower# sh run snmp-server
no snmp-server location
no snmp-server contact
no snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
firepower#

Screen shot from FMC also attached.

Re: SNMP Configration for FPR-2130 Through FMC GUI

netbeginner — Fri, 07 Feb 2020 13:36:30 GMT

One twist... with new issue

We have taken a deep dive to NMS and found FTD is available in NMS polling with management interface IP and which is not actually visible to us from CLI even from FMC too (this management IP of FTD is integrated with FMC at backend), This lead to understanding gap and we started trying to integrate FTD with NMS via a Data Interface IP on FTD (as mgmt IP is not visible there on CLI & FMC under FTP interface).

New problem is now is that - At NMS monitoring .... FTD is showing with management interface & few more (probably 3-4) interface with name tun1, tap0, tap0.1, tap0.100 which is of no purpose for us.

The desired state for which we are doing all this exercise is to get trap notification for all IPSec tunnel which are created on this FTP.

Would also like to understand, why snmp configuration are not reflecting there in FTD CLI, which were pushed from FMC

Hope, to get the solution now here in this forum/platform.

Re: SNMP Configration for FPR-2130 Through FMC GUI

Francesco Molino — Sat, 08 Feb 2020 04:07:07 GMT

If the config is pushed you should see it.
Have you tried disabling all snmp configuration and deploy to FTD, then reconfigure and deploy again?
If not working, can you try to disassociate the platform settings and deploy, then reassociate and redeploy.

If still not working, i would highly recommend to open a tac case.
Are you getting any error while deploying?

Re: SNMP Configration for FPR-2130 Through FMC GUI

netbeginner — Sat, 08 Feb 2020 05:46:03 GMT

Hi Francesco,

I tried everything, but since this is production environment i can't do much R&D even for SNMP.

Well, i have found other post in forum "https://community.cisco.com/t5/firepower/snmp-to-the-ftd-managment-interface/m-p/3915417/highlight/false#M14743" ....I have requested there to advice for solution.

Meanwhile, please continue to share your inputs Or if anyone having solution fix to problem . please help.

Re: SNMP Configration for FPR-2130 Through FMC GUI

Marvin Rhoads — Sun, 09 Feb 2020 07:11:59 GMT

As I noted in the other thread, you are correct that as of the current Firepower release (6.5.0.2) we still need to assign a separate IP address to the diagnostic interface. That allows the NMS to interact with the LINA code within Firepower which handles SNMP instrumentation of the dataplane. The management interface, while it will respond to SNMP if configured to do so, only handles SNMP instrumentation of the physical appliance as it is based within the FX-OS subsystem.

Expect this to change ca. Firepower 6.6 later this year.

(edited 2020-02-09 to reflect 6.6 info.)

Re: SNMP Configration for FPR-2130 Through FMC GUI

Francesco Molino — Sun, 09 Feb 2020 04:04:27 GMT

Ok we are talking about 2 issues. Getting info from the LINA using the diagnostic interface and the 1st pb you bring which is pushing snmp config that's not showing up into your FTD.
What I can propose is to export the platform settings config from the import/export menu and share it in private to see if i can test it on my firepower device. If you can do that, I'll give you my email in a private message.

For the other issue, you need to assign a different ip on the diagnostic as mentioned by @Marvin Rhoads

Still not available on 6.6

Re: SNMP Configration for FPR-2130 Through FMC GUI

nspasov — Sun, 09 Feb 2020 06:21:00 GMT

Hi Marvin, how are you? Support for SNMP management in the FPR-2100 through the Device Management Interface is coming in 6.6.0 and it will be available via the Platform Settings in FMC and FlexConfig in FDM.

Thank you for rating helpful posts!

Re: SNMP Configration for FPR-2130 Through FMC GUI

Marvin Rhoads — Sun, 09 Feb 2020 07:13:34 GMT

Hi Neno. I’m doing well. Hope you are too.

Thanks for the correction. I updated my earlier post to reflect that.

I look forward to the improvements coming in the next few releases.

Re: SNMP Configration for FPR-2130 Through FMC GUI

netbeginner — Sun, 09 Feb 2020 17:52:33 GMT

Hi Marvin and Neno,

Thanks very much for response.

Finally, we have to use Diagnostic Interface and configure IP on the same till we have 6.6 version. But can we use IP from same subnet which is there on Management Interface, this is because i am avoiding executing of additional ACL further. NMS server is on same subnet as of management Interface.

believe there would not be any impact of the Production services if i configure IP on Diagnostic interface.

Hi Francesco,

I have share screen shot with you already for configuration, setup and scenario is also explained. You may refer that for your Lab.

Additionally, referring to reply on other post - "The management ip address resides within the firepower part of FTD and not within Lina" .....Trying to understand this statement. is FPR-2130 having two segment inside it Firepower and FTD and what is difference between LINA , snort and FX-OS.

rgds

Re: SNMP Configration for FPR-2130 Through FMC GUI

Francesco Molino — Mon, 10 Feb 2020 02:37:51 GMT

I checked your screenshots and everything works fine on my side. I get the config pushed on my ftd.
The reason why I'm asking the export is to import it as is and see if something wrong happens not visible in your screenshots.

Re: SNMP Configration for FPR-2130 Through FMC GUI

netbeginner — Mon, 10 Feb 2020 17:53:08 GMT

Hello All,

We have configured diagnostic interface with the same IP which is configured on the FPR management interface for testing.

Now we have the same IP on Management Interface and Diagnostic Interface(Recently configured). below are the observation:

Just for Eg : IP : 10.10.100.20

1- Diagnostic Interface and IP address is now visible on FPR CLI, however actual management interface is still not.

2- Can see the snmp-server configuration on FPR CLI now which were pushed from FMC, earlier they were not available.

3- Diagnostic Interface IP (Recently configured) is not pinging from FPR itself.

4- On executing "show route 10.10.100.20" on FPR . it's showing no subnet available however IP is there on same FPR. beleive this is due to Management Interface.

5- No change in device status at NMS end.

Rgds

Re: SNMP Configration for FPR-2130 Through FMC GUI

Marvin Rhoads — Mon, 10 Feb 2020 18:09:41 GMT

To show the management address on an FTD device drop to expert mode from the clish and run:

ifconfig management0

To show the routes used by it, use:

route  | grep management

Re: SNMP Configration for FPR-2130 Through FMC GUI

netbeginner — Mon, 17 Feb 2020 12:32:44 GMT

Hi Marvin/All,

We have successfully polled FTD with new IP configured on diagnostic interface(LINA). but a new observation now is ....only Stand-by unit is sending SNMP traps PDU to monitoring server , whereas no Trap PDU from ACTIVE.

We checked everything, Like Failover State , SNMP Host , SNMP version or other related SNMP configuration.. All are fine.

Active Unit :

firepower# sh snmp-server statistics
3032 SNMP packets input
0 Bad SNMP version errors
0 Unknown community name
0 Illegal operation for community name supplied
0 Encoding errors
19877 Number of requested variables
0 Number of altered variables
4354 Get-request PDUs
0 Get-next PDUs
374 Get-bulk PDUs
0 Set-request PDUs (Not supported)
3032 SNMP packets output
0 Too big errors (Maximum packet size 1500)
0 No such name errors
0 Bad values errors
0 General errors
3032 Response PDUs
0 Trap PDUs

Stand-By Unit

firepower# sh snmp-server statistics
3716 SNMP packets input
0 Bad SNMP version errors
0 Unknown community name
0 Illegal operation for community name supplied
0 Encoding errors
19935 Number of requested variables
0 Number of altered variables
4362 Get-request PDUs
0 Get-next PDUs
374 Get-bulk PDUs
0 Set-request PDUs (Not supported)
4028 SNMP packets output
0 Too big errors (Maximum packet size 1500)
0 No such name errors
0 Bad values errors
0 General errors
3716 Response PDUs
312 Trap PDUs
firepower#

Regards

***

Re: SNMP Configration for FPR-2130 Through FMC GUI

Marvin Rhoads — Tue, 18 Feb 2020 03:23:27 GMT

Have there been events on the primary FTD appliance that should have caused traps to be generated?

If so, you might want to open a TAC case. There was a bug (not sure of the BugID) with respect to SNMP on HA pairs that only created an SNMPv3 user on the secondary firewall.

Re: SNMP Configration for FPR-2130 Through FMC GUI

netbeginner — Tue, 18 Feb 2020 12:06:22 GMT

Hi Marvin,

We are using SNMP version 2.

Thought to add very important information here, The purpose of doing all this exercise [i.e Integrating FTD with monitoring server via SNMP ] is to get VPN IPSec tunnel up/down TRAP notification on monitoring server and that notification event should be convert to ticket further.