Does ISE supports SNMPv3 Polling ?

[raghchan]

I have checked in the documentation and SNMPv3 traps are supported. But is SNMPv3 Polling also supported ?

[paul]

SNMPv3 polling is supported to network devices, but I don't believe it is supported to endpoints.  For endpoint profiling I only see options to enter SNMP v2 community strings.

[penncro1]

Has anyone been able to use ISE 2.3 to poll NADs (such as Cisco 2960S and 3560 switches) using SNMPv3? I have upgraded to the suggested IOS software in the switches. I believe my configs are correct as using the Paessler SNMP Tester was able to get information back. I have read about the AES256 issue but have only used AES128 encryption. How does ISE use the polled information on the NADs? Where is it recorded?

[paul]

I spent quite a bit of time trying to get it to work correctly at a customer. The customer also spent a fair amount of time trying to get it to work. We never could get it to work and punted to V2 read-only community string with ACL restrictions.

[penncro1]

Thanks for your input as I’m starting to think there is still a bug in this ISE 2.3 release.

I spent a lot of time also on this but have not been able to get it working. It comes back with:

SNMP request times out, or SNMP community/user auth data is incorrect.

I hope we hear from a Cisco TAC on this issue.

[Jason Kunst]

This is not Cisco TAC if you’re needing support please reach out to them to troubleshoot and open bugs

[hslai]

Henry's inquiry is actually not related to what asked in the original question, which is about how to use SNMPv3 to monitor ISE.

penncro1: In the future, please start your own thread. If you post your TAC case number and if time permits, I can take a quick look. If not already done, please try using some SNMP tool (e.g. snmpwalk or snmpget from Net-SNMP) to verify the SNMP configuration on your NADs.

[penncro1]

Thanks for all the feedback. Sorry about posting the wrong thread but thought it was all related to SNMPv3 on ISE. I did open a case with TAC (684244782) but have not hear back regarding the ability for ISE 2.3 to poll NADs using SNMPv3. Have used snmp test software and verified that the config on the NAD is correct. In addition, I also have Prime Infrastructure that is polling these devices using SNMPv3.

[hslai]

The assigned TAC engineer is currently out of office but he did notify you and provided you an alternative contact.

Meanwhile, I would suggest to turn DEBUG on profiler and also on the switch. Check profiler.log while recreating the issue and provide the debug log file to TAC. Also, it seems possible to perform a wired capture the SNMP exchanges and decode it using WireShark. There are some instructions on the net for that so I would suggest you to try that, as well, to understand better what might have gone wrong.

[hslai]

See also chyps's comment for Re: ISE - Test SNMP Access to a Node

[hslai]

To monitor ISE via SNMP, ISE 2.0 adds SNMPv3 support for both agents and traps. See CLI guide for configuration commands, such as snmp-server user

Below is an example of the configuration:

myISE/admin# configure
Enter configuration commands, one per line.  End with CNTL/Z.
myISE/admin(config)# snmp-server host 1.1.1.1 ?
  version  SNMP version to use for notification messages

myISE/admin(config)# snmp-server host 1.1.1.1 version ?
  1   Use SNMPv1
  2c  Use SNMPv2c
  3   Use SNMPv3

myISE/admin(config)# snmp-server host 1.1.1.1 version 3 ?
  <WORD>  Remote UserName (Max Size - 31)

myISE/admin(config)# snmp-server host 1.1.1.1 version 3 username ?
  <WORD>  Remote EngineID (Max Size - 40)

myISE/admin(config)# snmp-server host 1.1.1.1 version 3 username 0x80001f8880aa72ce403792785600000000 ?
  hash   Hash Passwords
  plain  Plain Passwords

myISE/admin(config)# snmp-server host 1.1.1.1 version 3 username 0x80001f8880aa72ce403792785600000000 plain ?
  <WORD>  Auth Password (Max Size - 40)

myISE/admin(config)# snmp-server host 1.1.1.1 version 3 username 0x80001f8880aa72ce403792785600000000 plain lab123123 ?
  <WORD>  Priv Password (Max Size - 40)

myISE/admin(config)# snmp-server host 1.1.1.1 version 3 username 0x80001f8880aa72ce403792785600000000 plain lab123123 lab123123
myISE/admin(config)# snmp-server host 1.1.1.1 version 3 testuser 0x80001f8880aa72ce403792785600000000 plain lab123123 lab123123
myISE/admin(config)# snmp-server user usertestname v3 plain lab123123 lab123123
myISE/admin# sh run | inc snmp
snmp-server enable
snmp-server host 1.1.1.1 version 3 testuser 0x80001f8880aa72ce403792785600000000 hash 20A4FEA5635C18EBD115CF8884EBDC99717FAB14 20A4FEA5635C18EBD115CF8884EBDC99
snmp-server engineID OFPEIMID9J1
snmp-server user usertestname v3 hash 0xcddaf9a603a1f5af20d3b5cfda37e31a134b4a09 0xcddaf9a603a1f5af20d3b5cfda37e31a

[Parag Mahajan]

FYI -- Below defect resolved in 2.2P3 if you are planning to use AES256 for SNMPv3

CSCvd03239    SNMPv3 with AES256 encryption for SNMP profiling probe does not work in ISE 1.1.x/1.x/2.x.