SNMP v3 Polling Configuration with ISE v2.4 P7

[Waldis]

SNMP v3 Polling Configuration with ISE v2.4 P7

Hey

Im trying to setup a SNMP v3 polling for ISE from my switches.

I have got SNMP v3 to work with Cisco Prime, but the same settings don't seem to apply to Cisco ISE.

Under "Administration-System-Deployment-Nodes-Profiling Configuration" I have activated SNMPQUERY and SNMPTRAP for each node.

Under each NAD i have configured SNMPv3, user, auth, priv.

Each switch is configured with SNMPv3

view- group ISO included

group - read, write, notify and context vlan- match prefix

user - user group version auth priv.

Then snmp-server host <IP> version 3 priv <user>

Enable all traps.

mac address-table notification change

mac address-table notification mac-move

Since it works with Prime it should work with ISE.

In ISE if I go to Context Visibility - Network Devices, and try to poll a "port config status" I only get error

Opening the report it says under status "Device IP address is not reachable".

But since the switch is added and works with ISE i think its reacheable... ;)

Have I forgot any commands or settings in ISE? 

How do i do a SNMPv3 connectivity check in ISE?

[paul]

Good luck to you.  I have spent hours trying to get SNMPv3 working at multiple customers and never got it working correctly.  I am convinced it never really worked.  I just tell customers to use SNMPv2 read-only community string.

If you get it working post your config.

[Parag Mahajan · Accepted solution]

SNMPv3 is not supppoted for Port config status report/ Network device session report. Same has been called out in

admin guide.

 

https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_01.html#id_27044

Also there is defect filed for this, 

CSCvj72980 : Port Config Status SNMP Query for Network Device in Context Visibilty not working SNMPv3

I request you to open TAC case and reference this defect that will give weitage to this defect to resolve early.

If you would like to test SNMPv3, then connect connect endpoint and check if attributes (ifinedex, etc) are populated in contect visibility.

SNMPV3 does work for ISE 2.4 for profiling , Earlier there was defect related to v3 which got resolved in patch 2.4 P2.

Some reference for SNMPv3 config.

https://community.cisco.com/t5/identity-services-engine-ise/ise-test-snmp-access-to-a-node/m-p/3514626#286681

[franklinb]

I'm not sure the answer provided is related to your problem. I have a basic issue with polling ISE nodes via SNMPv3 auth/priv sha/aes that was working in patch 6 and broke in patch 9. The polling data stopped immediately after rebooting from applying the patch.

If I try an SNMPWalk from the NMS I use it reports auth failure.

[Jason Kunst]

If something broke please report immediately to the TAC so they can get it to engineering to resolve

[franklinb]

TAC resolved it for me - we recreated the v3 user and it started working again. Perhaps the hash is not ported correctly after update. 

Also of note is that there is no option to specify priv and auth methods - SHA and AES 128 are default. 

[limlayhin]

Hi,

Can share configuration for snmp v3? You can hide sensitive info.

Alternatively, do you know any URL reference for such configuration? 

Thanks you very much....

[franklinb]

The CLI configuration is quite simple and is explained in the CLI Reference Guide:

https://www.cisco.com/c/en/us/td/docs/security/ise/2-7/cli_guide/b_ise_CLIReferenceGuide_27/b_ise_CLIReferenceGuide_27_chapter_011.html#wp1067793462

ise/admin(config)# snmp-server user testuser v3 hash authpassword privpassword