cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
7093
Views
15
Helpful
7
Replies

SNMP v3 Polling Configuration with ISE v2.4 P7

Waldis
Beginner
Beginner

SNMP v3 Polling Configuration with ISE v2.4 P7

Hey

Im trying to setup a SNMP v3 polling for ISE from my switches.

I have got SNMP v3 to work with Cisco Prime, but the same settings don't seem to apply to Cisco ISE.

 

Under "Administration-System-Deployment-Nodes-Profiling Configuration" I have activated SNMPQUERY and SNMPTRAP for each node.

Under each NAD i have configured SNMPv3, user, auth, priv.

 

Each switch is configured with SNMPv3

view- group ISO included

group - read, write, notify and context vlan- match prefix

user - user group version auth priv.

Then snmp-server host <IP> version 3 priv <user>

Enable all traps.

mac address-table notification change

mac address-table notification mac-move

 

Since it works with Prime it should work with ISE.

 

In ISE if I go to Context Visibility - Network Devices, and try to poll a "port config status" I only get error

Opening the report it says under status "Device IP address is not reachable".

But since the switch is added and works with ISE i think its reacheable... ;)

 

Have I forgot any commands or settings in ISE? 

How do i do a SNMPv3 connectivity check in ISE?

 

1 Accepted Solution

Accepted Solutions

Parag Mahajan
Cisco Employee
Cisco Employee

SNMPv3 is not supppoted for Port config status report/ Network device session report. Same has been called out in

admin guide.

 snmpv3 not supported for report.png

https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_01.html#id_27044

Also there is defect filed for this, 

CSCvj72980 : Port Config Status SNMP Query for Network Device in Context Visibilty not working SNMPv3
 

I request you to open TAC case and reference this defect that will give weitage to this defect to resolve early.

 

If you would like to test SNMPv3, then connect connect endpoint and check if attributes (ifinedex, etc) are populated in contect visibility.

SNMPV3 does work for ISE 2.4 for profiling , Earlier there was defect related to v3 which got resolved in patch 2.4 P2.

Some reference for SNMPv3 config.

 

https://community.cisco.com/t5/identity-services-engine-ise/ise-test-snmp-access-to-a-node/m-p/3514626#286681

View solution in original post

7 Replies 7

paul
Advocate
Advocate

Good luck to you.  I have spent hours trying to get SNMPv3 working at multiple customers and never got it working correctly.  I am convinced it never really worked.  I just tell customers to use SNMPv2 read-only community string.

 

If you get it working post your config.

Parag Mahajan
Cisco Employee
Cisco Employee

SNMPv3 is not supppoted for Port config status report/ Network device session report. Same has been called out in

admin guide.

 snmpv3 not supported for report.png

https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/admin_guide/b_ise_admin_guide_24/b_ise_admin_guide_24_new_chapter_01.html#id_27044

Also there is defect filed for this, 

CSCvj72980 : Port Config Status SNMP Query for Network Device in Context Visibilty not working SNMPv3
 

I request you to open TAC case and reference this defect that will give weitage to this defect to resolve early.

 

If you would like to test SNMPv3, then connect connect endpoint and check if attributes (ifinedex, etc) are populated in contect visibility.

SNMPV3 does work for ISE 2.4 for profiling , Earlier there was defect related to v3 which got resolved in patch 2.4 P2.

Some reference for SNMPv3 config.

 

https://community.cisco.com/t5/identity-services-engine-ise/ise-test-snmp-access-to-a-node/m-p/3514626#286681

franklinb
Beginner
Beginner
I'm not sure the answer provided is related to your problem. I have a basic issue with polling ISE nodes via SNMPv3 auth/priv sha/aes that was working in patch 6 and broke in patch 9. The polling data stopped immediately after rebooting from applying the patch.

If I try an SNMPWalk from the NMS I use it reports auth failure.

If something broke please report immediately to the TAC so they can get it to engineering to resolve

TAC resolved it for me - we recreated the v3 user and it started working again. Perhaps the hash is not ported correctly after update. 

 

Also of note is that there is no option to specify priv and auth methods - SHA and AES 128 are default. 

Hi,

Can share configuration for snmp v3? You can hide sensitive info.

 

Alternatively, do you know any URL reference for such configuration? 

 

Thanks you very much....

The CLI configuration is quite simple and is explained in the CLI Reference Guide:

https://www.cisco.com/c/en/us/td/docs/security/ise/2-7/cli_guide/b_ise_CLIReferenceGuide_27/b_ise_CLIReferenceGuide_27_chapter_011.html#wp1067793462

 

ise/admin(config)# snmp-server user testuser v3 hash authpassword privpassword

 

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers