configuring snmpv3 to read mac address table

[carl_townshend]

Hi All

I need to configure my NMS to read the mac address table of my 9600 switch via snmpv3, there are 100+ vlans on the switch and I want to read all mac addresses from all vlans.

For some reason it is not pulling back any mac addresses, if I use snmpv2 it works fine.

The config I have is below

snmp-server group nacgroup v3 priv read nacread write nacwrite

snmp-server user forescout nacgroup v3 auth sha TEST priv aes 256 TEST
snmp-server view nacread iso included

snmp-server view nacwrite iso included

Is this config enough? or do I need to change something?

Cheers

[marce1000]

         - Check if there is anything in the logs of the switch when this is tried.

 M.

[carl.townshend]

Hi 

I am seeing the following

15619404: May 11 15:37:07.660: SNMP: Packet received via UDP from 172.30.64.145 on GigabitEthernet0/0SrParseV3SnmpMessage: No matching Engine ID.
SrParseV3SnmpMessage: Failed.
SrDoSnmp: authentication failure, Unknown Engine ID

15619405: May 11 15:37:07.660: SNMP: Report, reqid 1216423989, errstat 0, erridx 0
internet.6.3.15.1.1.4.0 = 2
15619406: May 11 15:37:07.664: SNMP: Packet sent via UDP to 172.30.64.145
process_mgmt_req_int: UDP packet being de-queued

15619407: May 11 15:37:07.672: SNMP: Packet received via UDP from 172.30.64.145 on GigabitEthernet0/0SrParseV3SnmpMessage: not in lifetime failure
SrParseV3SnmpMessage: Failed.
SrDoSnmp: Packet not in Time Window

[marce1000]

 - Check if the Resolving-reply from this thread can help :

                       https://community.cisco.com/t5/network-management/snmpv3-authpriv-problem-not-in-time-windows/td-p/1987424

 M.

[carl.townshend]

Hi

What fixed it was moving the priv aes from 256bits to 128bits

Many thanks

[marce1000]

  - Tx for this info , very informative for the forum.

 M.

[prashantthinks]

IN NMS, while adding just go to permission mode and for MAC discovery try with SNMP and CLI option both.