Well, when we talked about how SNMP version 3 is a little bit complex, a lot of
this has
to do with the iOS XC CLI configuration.
This requires a little bit of practice because we might say, "Okay, it's super
straightforward.
I set it up with a username and password."
But unfortunately, it's not that simple.
Now, we'll see this.
NXOS, Cisco's Nexus platform, does this very, very well.
It's way easier to set up SNMP via NXOS, whereas CLI on the iOS XC takes a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It's way easier to set up SNMP via NXOS, whereas CLI on the iOS XC takes a
little bit
of overcoming frustration.
But that aside, let's just make sure that we understand how it works and that
we don't
need to worry about it anymore.
So the iOS XC architecture comes down to three concepts.
We have Views, Groups, and Users.
Now again, a user is going to be a true username and password combination. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now again, a user is going to be a true username and password combination.
And maybe that's on a radius server.
Maybe it's locally configured on the device.
But either way, I'm going to create a username and password.
And I'm going to set the security level for that particular username.
And so that's pretty simple.
So what about Views and Groups?
Well, Cisco's attempt to make this a little bit more of a modular configuration
style,
which is the trend with CLI.
We want to make things as modular as possible so I can apply different Views WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We want to make things as modular as possible so I can apply different Views
and Groups to
Users and have the different combinations in here so that whatever my needs are
, I can
very simply do that without having to reinvent the wheel, so to speak, and
configure things
fresh from the ground up every single time.
So when we start with Views, a View defines what aspects of a device that a
particular
SNMP manager and NMS can see.
So this is basically giving us our authorization concept. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So this is basically giving us our authorization concept.
It's letting us know what I can do on the device and what I can't do on the
device.
So in a lot of cases, we'll set this to say, hey, you can just have full access
to the device,
but maybe I want you to have partial access to the device.
Maybe I want you to see my Layer 2 configuration, but not my Layer 3
configurations and setting
up partial as we might imagine is going to require some SNMP knowledge around
the MIB
and the OIDs.
Now Groups, when we are looking at Groups, we're actually going to use this as WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now Groups, when we are looking at Groups, we're actually going to use this as
sort of
the way to glue our users to our Views.
So the Group is going to be created in Read or Write fashion.
So this is where we define that aspect of SNMP.
And then I also define the security that's going to be used.
Specifically I have three options.
I have no auth and no priv, all one word like this. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I have no auth and no priv, all one word like this.
And as we can tell, we're saying no authentication, no privacy, meaning no
encryption.
So this is basically saying no security.
We definitely don't want to use this, otherwise we might as well be using
version 2C.
Or we can set up auth no priv.
Okay, so that's giving us authentication.
So that's a start, but maybe we don't want to encrypt our traffic for one
reason or another.
So that is certainly an option. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So that is certainly an option.
The most secure option is going to be auth priv, and that is giving us
authentication,
and it's giving us encryption.
So when we say the users are getting their security level set up, we might have
to, for
example, make sure that we have the appropriate password and encryption level
in here.
So this is how the configuration comes together.
It's not that bad, but we can already see it's way more complex than version 2C
, which
simply requires setting a community string along with Read and Write WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
simply requires setting a community string along with Read and Write
operational levels.
So let's go ahead and flip over to our CLI and just do a quick configuration
just to
kind of show how this comes together.
So I'm going to do a config T on my router here, and I'm going to say SNMP
server and
create a view.
I'll just call this CBT view.
And then I can enable full access with ISO included.
So this is basically creating that view that allows for full access to the
device.
So that was the left side of our chalkboard. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So that was the left side of our chalkboard.
I have already created my view.
Now that's not too bad.
Now let's create my group.
SNMP server group.
And then I'm going to say CBT group.
And I'm going to specify this is for version three.
And then now I can specify that auth or that no auth or that priv level or
whatever it
is I want to do.
So I'm going to say priv here, then I can specify whether I want read or write.
I'll just call this read for read only.
And I map it to my view here.
So I can say CBT view. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So I can say CBT view.
All right, I already created my group.
No problem.
Well now I have to create my user.
So SNMP server user.
And let's go ahead and create a user name of, I'll just call it user.
Why not?
Capital USER for user.
And then I want to place it into a group.
So which group it belongs in.
So CBT group is the group name.
And then I've got to specify my parameter.
So I'm going to use the version three security model for this user.
I'm going to specify my authentication. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I'm going to specify my authentication.
Now I can decide again, this is where it's interesting.
I can set my security settings so I can go with MD5.
Usually we go with Shaw here.
So you're going to go with Shaw.
And then I specify my password of pass whatever our user name and password is
going to be.
And then again, I keep going.
So I just specified my authentication parameters.
But I need to now specify my priv or my encryption parameters as well.
So I can decide which version of encryption I want to use.
Should never use desert triple this in modern networks, so we'll specify AES. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Should never use desert triple this in modern networks, so we'll specify AES.
You can specify the level of AES, AES 256.
And then the privacy password here.
So I can enter a secret.
And then we've got the ability to also use an access control list if we so
desire.
So I can specify my user.
And that is how we go about creating the SNMP version three configuration on an
iOS XE device.