Skip to end of banner
Go to start of banner

Using SNMPv3 with NMIS for Secure Network Management

Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 2 Next »

NMIS supports using SNMPv3 for securing the collection of sensivite network information.  This is especially important from core switches and routers which if compromised could have a considerable business impact.

Configuring Cisco IOS for SNMPv3

The first step is to enable SNMPv3 on your router or switch.  If using Cisco IOS, the commands are below, if using other Cisco operating systems or other vendors, the concepts are the same and the commands will likely be similar.  The most important thing is that the device will support SNMPv3, it will require encryption features if you want to use full auth/priv mode.

snmp-server view NMIS8RO iso included
snmp-server group NMIS8 v3 priv match exact read NMIS8RO 
snmp-server user nmis8 NMIS8 v3 auth md5 nmis4242 priv des nmis4242

To view the configured SNMP users

asgard# show snmp user 
User name: nmis8
Engine ID: 800000090300001E13B18D00
storage-type: nonvolatile active
Authentication Protocol: MD5
Privacy Protocol: DES
Group-name: NMIS8

Testing your SNMPv3 Configuration with NET-SNMP

snmpwalk -v 3 -l authPriv -u nmis8 -a md5 -A nmis4242 -x DES -X nmis4242 asgard .1.3.6.1.2.1.1

 

Configuring NMIS8 for SNMPv3

Change Nodes.nmis Configuration

You will need to modify the NMIS8 configuration to use SNMPv3, the user name, protocols and passwords need to match the above IOS configuration.

 'version' => 'snmpv3',
 'authkey' => '',
 'username' => 'nmis8',
 'authpassword' => 'nmis4242',
 'authprotocol' => 'md5',
 'privpassword' => 'nmis4242',
 'privprotocol' => 'des',

Test SNMPv3 communication to the device

/usr/local/nmis8/bin/nmis.pl type=collect node=asgard debug=true

In the command output you are looking to verify that data was collected from the device, so any updates to an RRD will show that data was collected and is being stored.

--snip--
11:19:02 updateRRD, DS MemoryUsedPROC:MemoryFreePROC:avgBusy5:avgBusy1:bufferFail:bufferElHit:MemoryFreeIO:bufferElFree:MemoryUsedIO
11:19:02 updateRRD, value N:19299276:27249732:3:2:0:810903:30345952:1118:4257056
--snip--

 

Ensure NMIS has the necessary encryption modules installed, it may be missing Crypt::DES

install Crypt::DES

 

install Crypt::DES

  • No labels