Set up SNMPv3 authPriv monitoring and remote syslog on a router

Tasks

1. Allow SNMP queries only from 10.0.0.50.
2. Create a read-only SNMPv3 group at authPriv with a view of the standard MIB-2 tree and Cisco's enterprise tree.
3. Create user nmsuser in that group with SHA and AES-128.
4. Send SNMPv3 traps for link up, link down and configuration changes to NMS1.
5. Send syslog at informational and above to LOG1, keep a local buffer, and limit the console to warnings.
6. Verify the user, a successful poll, a refused poll from another host and a log message arriving on LOG1.

Solution

1. 1Access list and viewR1

   ip access-list standard SNMP-MGRS
    permit 10.0.0.50
   !
   snmp-server view NMS-VIEW 1.3.6.1.2.1 included
   snmp-server view NMS-VIEW 1.3.6.1.4.1.9 included

   1.3.6.1.2.1 is MIB-2 (system, interfaces, IP and more). 1.3.6.1.4.1.9 is Cisco's enterprise tree.

2. 2Group and userR1

   snmp-server group NMS-RO v3 priv read NMS-VIEW access SNMP-MGRS
   snmp-server user nmsuser NMS-RO v3 auth sha Auth-Pass-2026 priv aes 128 Priv-Pass-2026

   priv on the group means authPriv. No write view is given, so the group is read-only. The user line does not appear in the running config; check it with show snmp user.

3. 3Traps, source and ifIndex persistenceR1

   snmp-server trap-source Loopback0
   snmp-server ifindex persist
   snmp-server enable traps snmp linkdown linkup
   snmp-server enable traps config
   snmp-server host 10.0.0.50 version 3 priv nmsuser

   Traps need no acknowledgment, so the manager's engine ID is not required. Informs over v3 would need it.

4. 4SyslogR1

   service timestamps log datetime msec show-timezone
   logging buffered 64000 informational
   logging console warnings
   logging source-interface Loopback0
   logging host 10.0.0.60
   logging trap informational

Verify

R1# show snmp user
User name: nmsuser
Engine ID: 80000009030000A3D14F2B00
storage-type: nonvolatile        active
Authentication Protocol: SHA
Privacy Protocol: AES128
Group-name: NMS-RO

NMS1# snmpget -v3 -l authPriv -u nmsuser -a SHA -A 'Auth-Pass-2026' -x AES -X 'Priv-Pass-2026' 10.255.0.1 SNMPv2-MIB::sysName.0
SNMPv2-MIB::sysName.0 = STRING: R1

OTHER1# snmpget -v3 -l authPriv -u nmsuser -a SHA -A 'Auth-Pass-2026' -x AES -X 'Priv-Pass-2026' 10.255.0.1 SNMPv2-MIB::sysName.0
Timeout: No Response from 10.255.0.1.

R1# show logging | include Trap logging|Logging to
Trap logging: level informational, 58 message lines logged
    Logging to 10.0.0.60  (udp port 514, audit disabled,

LOG1# tail -n 1 /var/log/network/r1.log
Nov 10 10:02:41 10.255.0.1 58: Nov 10 10:02:40.512 UTC: %SYS-5-CONFIG_I: Configured from console by admin on vty0 (10.0.0.50)

Mistakes people make

• Looking for the SNMPv3 user in the running config and assuming it was not saved.
• Using a group level of auth and believing the traffic is encrypted. Only priv encrypts.
• Changing snmp-server engineID local later. Every user's keys become invalid and must be re-created.
• Passphrases shorter than 8 characters. net-snmp refuses them.
• Forgetting logging source-interface: messages arrive from whichever interface faces the server, and the syslog server files them under the wrong host.
• Sending debugging level to the syslog server and flooding it.

On other platforms

set snmp v3 usm local-engine user nmsuser authentication-sha authentication-password "Auth-Pass-2026"
set snmp v3 usm local-engine user nmsuser privacy-aes128 privacy-password "Priv-Pass-2026"
set snmp v3 vacm security-to-group security-model usm security-name nmsuser group NMS-RO
set snmp v3 vacm access group NMS-RO default-context-prefix security-model usm security-level privacy read-view NMS-VIEW
set snmp view NMS-VIEW oid 1.3.6.1.2.1 include
set system syslog host 10.0.0.60 any info
set system syslog source-address 10.255.0.1