In the previous video, we took a look at SNMP version 2C
see with its community string, which not too secure.
So we're going to kick it up a notch
in this video with the configuration of SNMP version
3.
So let's go to the command line on a new router
and let me show you the configuration for SNMP version
3.
And then to verify that it's working, we'll also
take a look at an NMS, a network management system, that also
supports SNMP version 3 that can interact and pull
this router to get all the details that it needs.
So to start this discussion with SNMP version 3, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So to start this discussion with SNMP version 3,
let's imagine that a router is like a house.
And in this house, most houses, many houses
have multiple rooms.
So we have room one and room two and room three.
And these rooms could represent living rooms, family rooms,
dining rooms, bathrooms, et cetera.
They have lots of things going on in the house.
Now with SNMP, we have options of giving access
to the entire house, meaning an SNMP manager could
go ahead and look at the router and look at anything, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
go ahead and look at the router and look at anything,
assuming we have the right MIB look at any detail
and if we have the read/write permissions,
write to the appropriate details of anything
on that managed device.
That's great.
That's the whole house.
But we also could partition it off.
We could say, you know what?
I don't want everybody to have full access.
Let's go ahead and take a couple parameters like this
and let's carve them into a view.
Think of a view like a subsection
of the entire device.
So instead of a house with six rooms,
we can create a view that only provides access WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we can create a view that only provides access
to two of those rooms, two specific rooms.
So that's the concept of the view.
So to create a view, I'll put this here in pink,
we would go ahead and simply create a view.
And here is examples of that right here.
And let's start with view one.
So for view one, I've got two entries.
So SNMP server view, the name view one,
and then this is-- think of this like a room in the house,
like room three.
That's going to be included as part of that view.
And then the second line, for the same view, same name, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then the second line, for the same view, same name,
I'm also adding the interface operational status
as maybe room four.
So anybody who is associate with that specific view
is only going to have access to rooms three and four, those two
specific objects or portions of the entire MIB regarding
that device.
Now the other option here is ISO.
So in this view called full, I'm using the keyword ISO,
and that effectively represents the entire ball of wax,
the front door, here's the keys to the front door,
you can access everything. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
you can access everything.
So on a specific device, you can go look up the MIBs
and look up the key terms for a specific device,
whether it's a server or router or switch,
because all the vendors have published those.
So you can actually create your views
based on what you want to give access to.
So with SNMP, what we're going to do
is we are going to create views.
And I'll put those in pink.
So views, they specify where.
Like where in this device can we have access to or see?
Now just because we have access to, in this view, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now just because we have access to, in this view,
to rooms three and four, in this case
it would be sysop time and interface operation status,
does that mean we can just read all the data
or we can change the data?
Do we have read only and rewrite access?
The answer is with SNMP version 3,
we would control that, and let e use a slightly different color,
let me use blue, we control that with groups.
So what we could do is-- let me erase some of this.
So with groups, we can specify the permissions WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So with groups, we can specify the permissions
based on a view.
So if we want to give a group specific permissions to do
read only regarding that view, right.
If we want to give a group read/write access to that view,
that's great.
We can control that with the groups.
Think of the groups like what, meaning
what are you allowed to do?
And I'll put read only and/or read/write right there as
far as the groups.
So here's some examples.
I'll put them in blue right.
Here here's three groups that we are creating for SNMP. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Here here's three groups that we are creating for SNMP.
So group A using version 3, we're
giving the access of read privileges to view number one.
So basically, this group has read access
to rooms three and four, which is in this view one, these two
parameters, two sections.
And then group B, also using version 3,
is given read access to full, the view called full,
and it's also given write access to that same view.
So if you happen to be assigned as a member, a user,
as a member of group B, wholly snikers, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
as a member of group B, wholly snikers,
you've got read access to full, which
is the entire house, the entire MIB on that managed device,
and you've got write access to the entire device.
So groups identify what you can do with the view
or with the entire box you've been given access to.
So the last piece of this puzzle is,
how do we authenticate a user who
is going to be a member of a group, who is going to then
have access to whatever permissions that group
has to the view?
And the answer is, we are going to create users.
Now these are not your normal iOS users. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now these are not your normal iOS users.
These are SNMP server users.
And check it out.
I did a show run include SNMP.
They do not show up in the running config.
We configured it.
They're there.
They are persistent.
But they are not showing up in the config.
So I'll walk you through that syntax in just a few seconds.
So a user is going to be associated with a group.
And then based on that group, with what access
they have to a view, are then going
to have the equivalent permissions regarding
that view.
And that's how you do it.
So with the user, we're going to have to do a few things. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So with the user, we're going to have to do a few things.
With a user, we're going to have to give them a name.
We're going to say what groups they are associated with.
We're also going specify whether or not
we want to take advantage of the version 3 security measures.
So the security measures include authentication.
Do we want to use it or not?
We don't have to, but we should.
And the other option is for encryption, which
is referred to as privacy.
So we need to specify, yeah, we want to use authentication.
We want to use privacy. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We want to use privacy.
And we're going to need keys, passwords for each of those,
and we're also going to have to specify the methods.
For authentication, are we going to use MD5?
Or are we going to use Sha?
And for the privacy, for the encryption,
are we going to use DEZ?
No.
We're not going to use DEZ.
We'll use AES.
It also asks us for a key length.
So if you want to use AES 256, assuming your network
management system supports it, great.
And then also the key for that as well. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then also the key for that as well.
So there's a little bit more work in setting that up,
but they don't show up here.
So let me show you the syntax for creating a brand new user.
All right, so let's create an SNMP user.
So we're going to configuration mode SNMP dash server, is
the syntax of how it starts.
And then we'll use some context sensitive help.
We'll create a user.
And let's call the user Jim.
All right.
So Jim, you're in.
And for Jim, which group does Jim belong to?
I'm going to scroll up just a little bit
and take a look at my output here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and take a look at my output here.
So let's put-- we have group A, group B, or the admin group.
And let's put him in the admin group.
Just going to paste that down.
So Jim is now a member of the admin group,
or will be once we finish this command.
And then, what version of SNMP?
V3, because that's what we're focused on here.
Then we're going to specify AUTH for authentication
and a question mark.
Let's use Sha.
And this should be planned out probably beforehand so you're
not making it up on the fly.
But we'll use Sha.
And then the word for the authentication, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then the word for the authentication,
I'm going to use Cisco exclamation mark 2 3.
Not a great one in production, but I'll
remember what it is here when we get to the management side.
And then a question mark and PRIV.
So the off portion is regarding the hashing and the integrity
for the authentication piece, and this PRIV part
is now talking about the encryption piece.
The authentication and encryption of the traffic
are the two major benefits of SNMP version 3.
So regarding PRIV, regarding the privacy, we'll use AES.
And if we're using AES, it's going
to ask about some key lengths. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to ask about some key lengths.
Let's go for 256 and a space.
And now it's asking for a password
for effectively the encryption.
So I'm going to use the same password.
Also not the best idea to use the same password
for authentication and for the encryption.
However, it'll work.
And then here, we can tag on an access control list.
It says, OK, x access list 10.
And we can specify a source address,
which if the packets or the SNMP management traffic coming in
isn't from those source addresses,
it's going to go ahead and be dropped.
In this case, I'm going to leave it off. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
In this case, I'm going to leave it off.
And check this out.
Show, run, include SNMP.
Not there.
So one of the aspects that's important to know
is that you're going to have some
of the configuration for SNMP version
3, the groups and the views, but you're not
going to have the actual user information.
So you need to do a command like this, show SNMP user
and press enter.
So here's our user of Jim.
And the authentication protocol is Sha, because we said it was.
And the privacy protocol is AES 256. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And the privacy protocol is AES 256.
And Jim is a member of admin group.
And here we have Bob.
And there's an access list associate with Bob.
Here's Lois.
So that's a great way of seeing who your users that
are configured for SNMP.
Because in troubleshooting, if you just did a show run, like,
there's no users.
It's can be tough to troubleshoot that.
So also when in doubt, you can make a new user
and then use that new user on the SNMP manager
just to rule out that you don't have a typo
or you forgot the password or whatever,
if you create them brand new on both sides. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
if you create them brand new on both sides.
OK.
So that's one show command.
Let's do a show SNMP and a question mark.
And let's go ahead and do a show SNMP view, right?
What views do we have?
If we scroll up to the top, we're
going to have those custom views as well.
Here's view one, which includes system uptime, which
also includes IF operations.
So here's full, which is including ISO.
So basically, it gives full- that view as full access.
So we have show SNMP view, show SNMP users,
and let's do a show SNMP group. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and let's do a show SNMP group.
So that way, with those commands,
we can identify the users, what groups they're a member of,
what groups have access to as far as
permissions, and then the actual views that those groups are
associated with.
All right.
So that's the basic configuration
of SNMP version 3 on a managed device on the agent.
Now in order to make these not too lengthy,
I'm going to go ahead and put the management piece, the SNMP
manager using version 3, in the very next video.
So it's coming right up.
So I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.