snmp port-security

[Peter von Nostrand]

We need to check with snmp if an interface has Security Violation Count other than 0. Is there any way to do this? Our switches are 2960S.

[Rolf Fischer · Accepted solution]

Hi Peter,

you can try CISCO-PORT-SECURITY-MIB cpsIfViolationCount:

snmpbulkwalk -v2c -c public -OQs 192.168.173.11 enterprises.9.9.315.1.2.1.1.9
enterprises.9.9.315.1.2.1.1.9.10101 = 0
enterprises.9.9.315.1.2.1.1.9.10102 = 0
enterprises.9.9.315.1.2.1.1.9.10103 = 0
(...)

HTH
Rolf

[Peter von Nostrand]

Hey Rolf, thx, but there is no such oid when I query the switch. Do I have to enable something else besides the snmp-server on the switch?

[Rolf Fischer]

Could you share the snmp-server config of your switch (remove the community strings, if existing) and the output of 'show port-security'?

[Peter von Nostrand]

Sure, it's just this one:

snmp-server community public RO

[Rolf Fischer]

Hm, and you have port-security enabled on at least one interface?

What IOS version are you running?

[Peter von Nostrand]

Yes, I have it configured on an interface. The IOS version is 15.0(1) SE2.

[Rolf Fischer]

Unfortunately I won't have access to our switches until tomorrow morning and I can't recall what version we're using on this platform.

What happends when you query 1.3.6.1.4.1.9.9.315 (ciscoPortSecurityMIB)?

Does the switch respond when you query other objects, for instance the System MIB?

[Peter von Nostrand]

Rolf, thanks for your time. I did a test using snmp v2 and it was OK. 

Thanks again.

[Rolf Fischer]

Glad to hear that it works. Thanks for using the rating system :)