Cisco SG300 SNMP with cacti

[parisvcisco]

I've installed Cacti on ubuntu 14.04 and am trying to add a Cisco sg300 to it.

so the switch is configured like this:
snmp-server location My Office
snmp-server contact sysadmin@blah
snmp-server community MyC0mmun1ty ro 192.168.10.25 view Default

then in the device settings I have

Description switchname
Hostname ip of switch

Host template cisco router
number of threads 1
disable host unticked

downed device detection snmp uptime
ping timeout 400
pin retry 1

snmp version 2
snmp community MyC0mmun1ty
snmp port 161
snmp timeout 500
max oids 10

from the cacti server (192.168.10.25) if I 
nmap -sU -p 161 switch ip is see:
161/udp open snmp

also on the sg300 I had to enable snmp in the security settings where ssh/telnet etc is and have saved the config.

But cacti shows
SNMP Information
SNMP error

[Michal Bruncko]

Hello

from your configuration seems that snmp-agent is not running on switch, you have to issue following command:

snmp-server server

then you can check if SNMP agent is running on your switch with Ubuntu command:

snmpwalk -v 2c -c MyC0mmun1ty X.X.X.X sysUpTime

...where X.X.X.X is your switch IP. You should get switch uptime.

If you haven't that command in your ubuntu server, you have to install "net-snmp" package.

[parisvcisco]

Thanks

When I run snmpwalk I get: sysUpTime: Unknown Object Identifier (Sub-id not found: (top) -> sysUpTime)

[parisvcisco]

Not sure if I need to change this?

[Michal Bruncko]

from your output seems to be everything fine. sysUpTime has Object ID "1.3.6.1.2.1.1.3" so you can try to use OID instead of "sysUpTime":

snmpwalk -v 2c -c MyC0mmun1ty X.X.X.X 1.3.6.1.2.1.1.3

[parisvcisco]

~# snmpwalk -v2c -c MyC0mmun1ty  192.168.10.2 1.3.6.1.2.1.1.3

Timeout: No Response from 192.168.10.2

[Michal Bruncko]

What about output "show snmp"? can you paste it here?

> Timeout: No Response from 192.168.10.2

this can be caused by two reasons:

1. SNMP Agent still not running (have you issued command "snmp-server server"?)
2. Wrong community string (yes, if you provide wrong community string, it silently fails (i.e. no response)). No matter which community is used - either readonly or readwrite can be used.

[parisvcisco]

no it still shows snmp error. I tried removing and adding the device.

#sh snmp


SNMP is enabled.



  Community-String    Community-Access    View name     IP address      Mask     

-------------------- ------------------ -------------- ------------ ------------ 

     MyC0mmun1ty          read only         Default    192.168.10.35                

 

 Community-String   Group name      IP address             Mask          Type  

------------------ ------------ ------------------- ------------------- ------ 

 

Traps are enabled.

Authentication-failure trap is enabled.


Version 1,2 notifications

 Target Address    Type    Community   Version   Udp   Filter   To    Retries  

                                                 Port  name     Sec            

---------------- -------- ----------- ---------- ----- ------- ----- --------- 



Version 3 notifications

 Target Address    Type    Username   Security Udp   Filter   To    Retries  

                                      Level    Port  name     Sec            

---------------- -------- ----------- -------- ----- ------- ----- --------- 

 

System Contact: sysadmin@

System Location: Office

[Michal Bruncko]

for me it looks like typo in configuration. Your cacti server has IP 192.168.10.25, but from "show snmp" output you have configured IP 192.168.10.35 instead.

If IP's not match -> access denied -> no response from SNMP agent. Behavior is same like with using wrong community string.

[parisvcisco]

Thanks that was an error on my part when I pasted, I deleted the last octet by accident and manually wrote it in.

The ip in sh snmp is in fact 192.168.10.25

If I try snmpwalk with an oid shown on the screen shot

~# snmpwalk -v2c -c MyC0mmun1ty  192.168.10.2 1.3.6.1.6.3.13

On the switch I see:

switch1#28-Dec-2011 20:14:50 %SNMP-W-SNMPAUTHFAIL: Access attempted by unauthorized NMS

hmm just noticed ntp needs setting up too!

[Michal Bruncko · Accepted solution]

Ok, I would suggest to enable SNMP agent on switch without IP restriction, i.e replace command:

snmp-server community MyC0mmun1ty ro 192.168.10.25 view Default

with command:

snmp-server community MyC0mmun1ty ro view Default

and try to snmpwalk again. If it will work now, then your SNMP requests from Cacti server are sourcing from another IP than 192.168.10.25 (have your Cacti server configured multiple IP's?).

[parisvcisco]

Yes that works!

I wonder if it's because the cacti server is a virtual machine on hyper-v?

That is definitely it's ip address as I ssh to it and ran the command from there. It only has one nic active and if config show's the right ip.

Thanks for your help appreciated.

[Michal Bruncko]

> I wonder if it's because the cacti server is a virtual machine on hyper-v?

that shouldn't be reason - in all cases IP assigned to your server must be used - but there could be multiple IP's assigned or perhaps your IP can be NAT'ted somewhere on some layer on way to switch. You can provide output from command "ip a" and "ip ro" on Ubuntu server in order to see your server IP network configuration.

[Michal Bruncko]

But nevertheless of this error you should be able to get SNMP data from your switch via Cacti.