el 11-12-2017 11:54 PM
I have checked in the documentation and SNMPv3 traps are supported. But is SNMPv3 Polling also supported ?
el 11-13-2017 05:24 AM
SNMPv3 polling is supported to network devices, but I don't believe it is supported to endpoints. For endpoint profiling I only see options to enter SNMP v2 community strings.
el 04-12-2018 01:16 PM
Has anyone been able to use ISE 2.3 to poll NADs (such as Cisco 2960S and 3560 switches) using SNMPv3? I have upgraded to the suggested IOS software in the switches. I believe my configs are correct as using the Paessler SNMP Tester was able to get information back. I have read about the AES256 issue but have only used AES128 encryption. How does ISE use the polled information on the NADs? Where is it recorded?
el 04-12-2018 02:01 PM
I spent quite a bit of time trying to get it to work correctly at a customer. The customer also spent a fair amount of time trying to get it to work. We never could get it to work and punted to V2 read-only community string with ACL restrictions.
el 04-12-2018 02:07 PM
Thanks for your input as I’m starting to think there is still a bug in this ISE 2.3 release.
I spent a lot of time also on this but have not been able to get it working. It comes back with:
SNMP request times out, or SNMP community/user auth data is incorrect.
I hope we hear from a Cisco TAC on this issue.
el 04-12-2018 02:17 PM
This is not Cisco TAC if you’re needing support please reach out to them to troubleshoot and open bugs
el 04-12-2018 08:43 PM
Henry's inquiry is actually not related to what asked in the original question, which is about how to use SNMPv3 to monitor ISE.
penncro1: In the future, please start your own thread. If you post your TAC case number and if time permits, I can take a quick look. If not already done, please try using some SNMP tool (e.g. snmpwalk or snmpget from Net-SNMP) to verify the SNMP configuration on your NADs.
el 04-13-2018 06:25 AM
Thanks for all the feedback. Sorry about posting the wrong thread but thought it was all related to SNMPv3 on ISE. I did open a case with TAC (684244782) but have not hear back regarding the ability for ISE 2.3 to poll NADs using SNMPv3. Have used snmp test software and verified that the config on the NAD is correct. In addition, I also have Prime Infrastructure that is polling these devices using SNMPv3.
el 04-15-2018 12:29 PM
The assigned TAC engineer is currently out of office but he did notify you and provided you an alternative contact.
Meanwhile, I would suggest to turn DEBUG on profiler and also on the switch. Check profiler.log while recreating the issue and provide the debug log file to TAC. Also, it seems possible to perform a wired capture the SNMP exchanges and decode it using WireShark. There are some instructions on the net for that so I would suggest you to try that, as well, to understand better what might have gone wrong.
el 04-15-2018 12:35 PM
See also chyps's comment for Re: ISE - Test SNMP Access to a Node
el 11-13-2017 06:59 AM
To monitor ISE via SNMP, ISE 2.0 adds SNMPv3 support for both agents and traps. See CLI guide for configuration commands, such as snmp-server user
Below is an example of the configuration:
myISE/admin# configure
Enter configuration commands, one per line. End with CNTL/Z.
myISE/admin(config)# snmp-server host 1.1.1.1 ?
version SNMP version to use for notification messages
myISE/admin(config)# snmp-server host 1.1.1.1 version ?
1 Use SNMPv1
2c Use SNMPv2c
3 Use SNMPv3
myISE/admin(config)# snmp-server host 1.1.1.1 version 3 ?
<WORD> Remote UserName (Max Size - 31)
myISE/admin(config)# snmp-server host 1.1.1.1 version 3 username ?
<WORD> Remote EngineID (Max Size - 40)
myISE/admin(config)# snmp-server host 1.1.1.1 version 3 username 0x80001f8880aa72ce403792785600000000 ?
hash Hash Passwords
plain Plain Passwords
myISE/admin(config)# snmp-server host 1.1.1.1 version 3 username 0x80001f8880aa72ce403792785600000000 plain ?
<WORD> Auth Password (Max Size - 40)
myISE/admin(config)# snmp-server host 1.1.1.1 version 3 username 0x80001f8880aa72ce403792785600000000 plain lab123123 ?
<WORD> Priv Password (Max Size - 40)
myISE/admin(config)# snmp-server host 1.1.1.1 version 3 username 0x80001f8880aa72ce403792785600000000 plain lab123123 lab123123
myISE/admin(config)# snmp-server host 1.1.1.1 version 3 testuser 0x80001f8880aa72ce403792785600000000 plain lab123123 lab123123
myISE/admin(config)# snmp-server user usertestname v3 plain lab123123 lab123123
myISE/admin# sh run | inc snmp
snmp-server enable
snmp-server host 1.1.1.1 version 3 testuser 0x80001f8880aa72ce403792785600000000 hash 20A4FEA5635C18EBD115CF8884EBDC99717FAB14 20A4FEA5635C18EBD115CF8884EBDC99
snmp-server engineID OFPEIMID9J1
snmp-server user usertestname v3 hash 0xcddaf9a603a1f5af20d3b5cfda37e31a134b4a09 0xcddaf9a603a1f5af20d3b5cfda37e31a
el 11-13-2017 12:52 PM
FYI -- Below defect resolved in 2.2P3 if you are planning to use AES256 for SNMPv3
CSCvd03239 SNMPv3 with AES256 encryption for SNMP profiling probe does not work in ISE 1.1.x/1.x/2.x.
Descubra y salve sus notas favoritas. Vuelva a encontrar las respuestas de los expertos, guías paso a paso, temas recientes y mucho más.
¿Es nuevo por aquí? Empiece con estos tips. Cómo usar la comunidad Guía para nuevos miembros