topic Re: snmp DNAC to C9800 in Wireless

snmp DNAC to C9800

j.madison — Wed, 15 Mar 2023 21:56:13 GMT

Hello,

I am trying to get my DNAC talking to my C9800 controllers via SNMP. I have matched the settings on both sides several times and it will not sync. Every time I blow away the SNMP account settings on the C9800-40 (v17.6.4) and recreate them it keeps changing the Group Name to SnmpAuthPrivGroup instead of the group name I define. It won't stop doing this. I also note that when I do a show snmp community on the C9800 it shows a long list of community names even though the WebUI is only showing one.

Any advice?

Re: snmp DNAC to C9800

Flavio Miranda — Wed, 15 Mar 2023 22:49:01 GMT

Are you creating a Discovery profile under Tools> Discovery and enter the WLC´s information?

Re: snmp DNAC to C9800

j.madison — Thu, 16 Mar 2023 15:12:38 GMT

The controllers are already discovered and reachable, the SNMP just won't sync up. I've tore down SNMP ends and rebuilt them multiple times and every time I do this the C9800 just changes out the Group-Name to SnmpAuthPrivGroup, regardless of what I manually configure. Wondering if this is a new feature (bug) on the controllers. 😕

Re: snmp DNAC to C9800

j.madison — Thu, 16 Mar 2023 15:15:04 GMT

Re: snmp DNAC to C9800

Scott Fella — Thu, 16 Mar 2023 15:46:42 GMT

You also need to configure the "Auth" also not just the "Priv". Then you will see an option for what you are looking for. This is how you configure snmpv3 for auth/priv.

Hope that helps.

Re: snmp DNAC to C9800

Scott Fella — Thu, 16 Mar 2023 15:54:32 GMT

Here is a screen shot of mine at home:

Re: snmp DNAC to C9800

j.madison — Thu, 16 Mar 2023 15:59:20 GMT

Hi Scott,

I created a new wlc-v3group Auth and wlc-v3groiup Priv so there are two groups on the C9800. When I create any new user and select either the wlc-v3group Auth or Priv Group-Name the controller continues to change all the group names the users are using to SnmpAuthPrivGroup.

Perhaps I'm not understanding your advice here?

Re: snmp DNAC to C9800

Scott Fella — Thu, 16 Mar 2023 16:22:16 GMT

I'm just going off of what you had provided, which you were missing the "Auth". Here is my V3 User screen shot:

Re: snmp DNAC to C9800

Scott Fella — Thu, 16 Mar 2023 16:24:38 GMT

Here are my options when I create a new user:

Re: snmp DNAC to C9800

Scott Fella — Thu, 16 Mar 2023 16:27:33 GMT

Maybe use the cli to configure this:

snmp-server group <v3-group-name> v3 auth write v1default
snmp-server user <v3-user-name> <v3-group-name> v3 auth sha <auth-password> priv aes 128 <encryption-password> access <access-list-number>

Re: snmp DNAC to C9800

j.madison — Thu, 16 Mar 2023 16:30:28 GMT

Hi Scott,

I see those exact options on the drop down and whether I select the one with (Auth) or (Priv) and hit apply it is changed both to the the group-name: SnmpAuthPrivGroup. I've even blown away SNMP altogether and started over, making those different group names (auth) and (priv) and went through creating a user and selected the group names and it still changes them to SnmpAuthPrivGroup.

Re: snmp DNAC to C9800

Scott Fella — Thu, 16 Mar 2023 16:31:37 GMT

Even from the cli?

Re: snmp DNAC to C9800

j.madison — Thu, 16 Mar 2023 16:36:15 GMT

Well when I use the CLI and not the WebUI it does this correctly. Going to test it out now with DNA.

Re: snmp DNAC to C9800

Scott Fella — Thu, 16 Mar 2023 16:39:35 GMT

I use the cli for as much as I can so I can automate. I haven't used the GUI for this, but this is how I got my controllers to use snmpv3 to communicate with Prime, DNAc and other tools via snmpv3.

Let me know if that works for you.

Re: snmp DNAC to C9800

Scott Fella — Thu, 16 Mar 2023 17:25:34 GMT

@j.madison did that work for you? Or are you still having issues with snmpv3?

Re: snmp DNAC to C9800

j.madison — Thu, 16 Mar 2023 17:38:19 GMT

Still not syncing with DNAC. I turned some SNMP debugging on, the WLC side but not showing much.

---

XXXXX # show snmp user

User name: wlc-v3user
Engine ID: 800000090300706D153D928C
storage-type: nonvolatile active
Authentication Protocol: MD5
Privacy Protocol: AES128
Group-name: wlc-v3group

XXXXX #show snmp host
Notification host: 10.20.68.10 udp-port: 162 type: trap
user: wlc-v3user security model: v3 priv

10.20.68.10 is my DNAC box.

Re: snmp DNAC to C9800

Scott Fella — Thu, 16 Mar 2023 17:44:13 GMT

I had to change mine to use SHA not MD5 as I get an error when I tried MD5. That seems to be the only difference I have on mine vs what you have. Try to use a linux machine or another tool to test snmpv3 get before you tinker too much with DNAc.

Re: snmp DNAC to C9800

Scott Fella — Thu, 16 Mar 2023 17:47:02 GMT

Here is a snippet from a guide:

MD5 and DES/3DES are insecure protocols and although they are still an option in the 9800, they must not be selected and are not fully tested anymore.

Re: snmp DNAC to C9800

j.madison — Thu, 16 Mar 2023 17:48:07 GMT

That was it, MD5 hosed it and SHA sync'd up. Thanks Scott!

Re: snmp DNAC to C9800

Scott Fella — Thu, 16 Mar 2023 18:08:39 GMT

Glad that worked. I couldn't recall offhand what I changed, but I did run into that issue when I migrated all IOS-XE from snmpv2 to snmpv3.