Table of Contents Chapter 1 SNMP Configuration Commands

Transcription

1 Table of Contents Table of Contents SNMP Configuration Commands display snmp-agent local-engineid display snmp-agent community display snmp-agent group display snmp-agent mib-view display snmp-agent statistics display snmp-agent sys-info display snmp-agent usm-user enable snmp trap updown snmp-agent community snmp-agent group snmp-agent local-engineid snmp-agent mib-view snmp-agent packet max-size snmp-agent sys-info snmp-agent target-host snmp-agent trap enable snmp-agent trap if-mib link extended snmp-agent trap life snmp-agent trap queue-size snmp-agent trap source snmp-agent usm-user undo snmp-agent i

2 1.1 SNMP Configuration Commands display snmp-agent local-engineid display snmp-agent local-engineid Any view local-engineid: Local engine ID. remote-engineid: Remote engine ID. Use the display snmp-agent local-engineid command to view engine ID of current device. SNMP engine is the core of SNMP entity. It performs the function of sending, receiving and authenticating SNMP message, extracting PDU, packet encapsulation and the communication with SNMP application, and so on. # Display the engine ID of current device. <H3C> display snmp-agent local-engineid SNMP local EngineID: DB00E0FC0000FF6877 The above displayed information SNMP local engine ID represents local SNMP engine ID display snmp-agent community display snmp-agent community [ read write ] Any view 1-1

3 read: Displays read-only community information. write: Displays read-write community information. Use the display snmp-agent community command to view the currently configured community names. # Display the currently configured community names. <H3C> display snmp-agent community Community name:public Group name:public Storage-type: nonvolatile Community name:private Group name:private Storage-type: nonvolatile Table 1-1 display snmp-agent community command output description Field community name Group name storage-type Community name Group name Storage mode display snmp-agent group display snmp-agent group [ group-name ] Any view groupname: Group name. Use the display snmp-agent group command to view group name, security mode, state of various views and storage modes. 1-2

4 # Display SNMP group name and safe mode. <H3C> display snmp-agent group Group name: test Security model: v2c noauthnopriv Readview: Default Writeview: <no specified> Notifyview :<no specified> Storage-type: nonvolatile The following table describes the output fields. Table 1-2 display snmp-agent group command output description Field groupname Security model readview writeview notifyview storage-type SNMP Group name The security mode adopted by SNMP Read-only MIB view name corresponding to that group Writable MIB view corresponding to that group The name of the notify MIB view corresponding to that group Storage mode display snmp-agent mib-view display snmp-agent mib-view [ exclude include { viewname mib-view } ] Any view exclude: Displays the SNMP MIB view excluded. Include: Displays the SNMP MIB view included. viewname: Displays the SNMP MIB view according to the mib view name. mib-view: Specifies the MIB view name. Use the display snmp-agent mib-view command to view the MIB view configuration information of the switch. 1-3

5 # Display the information about the currently configured MIB view. <H3C> display snmp-agent mib-view name:default MIB Subtree:internet Subtree mask: Storage-type: nonvolatile Type:included status:active name:default MIB Subtree:snmpUsmMIB Subtree mask: Storage-type: nonvolatile Type:excluded status:active name:default MIB Subtree:snmpVacmMIB Subtree mask: Storage-type: nonvolatile Type:excluded status:active Table 1-3 display snmp-agent mib-view command output description Field name MIB Subtree Subtree mask storage-type Type status name MIB subtree Subtree mask Storage type Permit or forbid access to an MIB object Indicate the line state in the table Caution: If the SNMP Agent is disabled, "Snmp Agent disabled" will be displayed after you execute the above display commands. 1-4

6 1.1.5 display snmp-agent statistics display snmp-agent statistics Any view None Use the display snmp-agent statistics command to view current state of SNMP communication. This command provides a counter for SNMP operations. # Display the current state of SNMP communication. <H3C> display snmp-agent statistics 0 Messages delivered to the SNMP entity 0 Messages which were for an unsupported version 0 Messages which used a SNMP community name not known 0 Messages which represented an illegal operation for the community supplied 0 ASN.1 or BER errors in the process of decoding 9 Messages passed from the SNMP entity 0 SNMP PDUs which had badvalue error-status 0 SNMP PDUs which had generr error-status 0 SNMP PDUs which had nosuchname error-status 0 SNMP PDUs which had toobig error-status (Maximum packet size 2000) 9 MIB objects retrieved successfully 0 MIB objects altered successfully 0 GetRequest-PDU accepted and 9 GetNextRequest-PDU accepted and 0 GetBulkRequest-PDU accepted and 9 GetResponse-PDU accepted and 0 SetRequest-PDU accepted and 0 Trap PDUs accepted and 0 Alternate Response Class PDUs droped silently 0 Forwarded Confirmed Class PDUs droped silently 1-5

7 Table 1-4 display snmp-agent statistics command output description Field 9 Get-next PDUs accepted and 0 GetBulkRequest-PDU accepted and 0 GetResponse PDUs accepted and 0 Set-request PDU accepted and 0 Trap PDUs accepted and 0 Alternate Response Class PDUs droped silently 0 Forwarded Confirmed Class PDUs droped silently 9 Get-next PDUs accepted and 0 GetBulkRequest-PDU accepted and 0 GetResponse PDUs accepted and 0 Set-request PDU accepted and Total number of the input SNMP packets Number of packets with version information error Number of packets with community name error Number of packets with authority error corresponding to the community name Number of SNMP packets with encoding error Number of SNMP data packets output Number of SNMP packets with erroneous values Number of SNMP packets with general error Number or packets request for nonexistent MIB objects Number of too long SNMP packets Number of variables requested by NMS 0 Trap PDUs accepted and Number of variables sent by NMS 0 Alternate Response Class PDUs droped silently 0 Forwarded Confirmed Class PDUs droped silently 9 Get-next PDUs accepted and 0 GetBulkRequest-PDU accepted and 0 GetResponse PDUs accepted and 0 Set-request PDU accepted and Number of the received packets requested by get Number of the received packets requested by get-next Number of the received packets requested by getbulk Number of the response packets sent Number of the trap messages sent Number of the response packets dropped 0 Trap PDUs accepted and Number of the trap messages dropped 1-6

8 1.1.6 display snmp-agent sys-info display snmp-agent sys-info [ contact location version ]* Any view None Use the display snmp-agent sys-info command to view the character string syscontact (system contact), character string describing the system location and the version information about the running SNMP in the system. # Display the character string syscontact. <H3C> display snmp-agent sys-info contact The contact person for this managed node: Hangzhou H3C Technologies Co.,Ltd. The above information represents that the contact person for this machine is Hangzhou H3C Technologies Co.,Ltd. # Display the character string describing the system location. <H3C> display snmp-agent sys-info location The physical location of this node: Hangzhou, China The above information represents that the physical location of this machine is: Hangzhou, China. # Display the version information of running SNMP <H3C> display snmp-agent sys-info version SNMP version running in the system: SNMPv3 The above information represents that the SNMP version running in the system is: SNMPv3. 1-7

9 1.1.7 display snmp-agent usm-user display snmp-agent usm-user [ engineid engineid group groupname username username ]* Any view engineid: Displays user information with specified engine ID. username: Displays user information with specified user name. groupname: Displays user information of specified group. Use the display snmp-agent usm-user command to view information of all the SNMP usernames in the group username list. SNMP user is the remote user executing SNMP administrative operation. You can use the snmp-agent usm-user command to specify the SNMP user. # Display the information of all the current users. <H3C> display snmp-agent usm-user User name: NotifyV3 Group name: NotifyGroup AuthenticationAuthencation Mode: sha Privacy Mode: des Engine ID: DB00E0FC active User name: publicv3 Group name: groupv3 AuthenticationAuthencation Mode: no Privacy Mode: no Engine ID: DB00E0FC active Acl:2000 Table 1-5 display snmp-agent usm-user command output description User name Field Group name Character string identifying the SNMP user Character string identifying the group the user belongs to 1-8

10 Field Authentication Mode Privacy Mode Engine ID Acl Authentication code Personal code Character string identifying the SNMP device Character string identifying the access control list enable snmp trap updown enable snmp trap updown undo enable snmp trap updown Ethernet port view, VLAN interface view None Use the enable snmp trap updown command to enable current port or VLAN interface to transmit the link up and link down trap messages. Use the undo enable snmp trap updown command to disable current port or VLAN interface from transmitting link up and link down trap messages. The enable snmp trap command should be used in cooperation with the snmp-agent trap enable and the snmp-agent target-host commands. The snmp-agent target-host command is used to specify which hosts can receive the trap messages. To enable the transmitting of trap messages, you must execute the snmp-agent target-host command at least once. # Enable port Ethernet 6/1/1 to transmit link up and link down trap messages with the community name public. System : return to User with Ctrl+Z. [H3C-Ethernet6/1/1] snmp trap updown enable [H3C] snmp-agent target-host trap address udp-domain params securityname public [H3C] interface ethernet6/1/1 [H3C-Ethernet6/1/1] enable snmp trap updown 1-9

11 1.1.9 snmp-agent community snmp-agent community { read write } community-name [ [ mib-view view-name ] [ acl acl-list ] ] undo snmp-agent community community-name read: Indicates that MIB object can only be read. write: Indicates that MIB object can be read and written. community-name: Community name character string. view-name: MIB view name. acl acl-list: sets access control list for specified community. Use the snmp-agent community command to configure community access name and enable the access to SNMP. Use the undo snmp-agent community command to cancel the settings of community access name. # Configure community name as comaccess and permits read-only access by this community name. System : return to User with Ctrl+Z. [H3C] snmp-agent community read comaccess # Configure community name as mgr and permits read-write access. [H3C] snmp-agent community write mgr # Delete the community name comaccess. [H3C] undo snmp-agent community comaccess snmp-agent group snmp-agent group { v1 v2c } group-name [ read-view read-view ] [ write-view write-view ] [ notify-view notify-view ] [ acl acl-list ] 1-10

12 undo snmp-agent group { v1 v2c } group-name snmp-agent group v3 group-name [ authentication privacy ] [ read-view read-view ] [ write-view write-view ] [notify-view notify-view ] [ acl acl-list ] undo snmp-agent group v3 group-name [ authentication privacy ] v1: SNMPv1 security mode. v2c: SNMPv2c security mode. v3: SNMPv3 security mode. group-name: Group name, ranging from 1 to 32 bytes. authentication: Configures to authenticate the packet without encryption. privacy: Configures to authenticate and encrypt the packet. read-view: Configures to allow read-only view settings. read-view: Read-only view name, ranging from 1 to 32 bytes. write-view: Configures to allow read-write view settings. write-view: Name of read-write view, ranging from 1 to 32 bytes. notify-view: Configures to allow notify view settings. notify-view: Specifies the notify view name, ranging from 1 to 32 bytes. acl Sets access control list for this group name. acl-list: access control list Use the snmp-agent group command to configure a new SNMP group, that is, to map SNMP user to SNMP view. Use the undo snmp-agent group command to cancel a specified SNMP group. By default, the SNMP group configured using the snmp-agent group v3 command is in none authentication mode. Related commands: snmp-agent mib-view, snmp-agent usm-user. # Create an SNMP group named test. System : return to User with Ctrl+Z. [H3C] snmp-agent group v3 test. 1-11

13 snmp-agent local-engineid snmp-agent local-engineid engineid undo snmp-agent local-engineid engineid: Engine ID, an even number of hexadecimal characters, in the range 10 to 64. Its length must not be an odd number, and the all-zero and all-f strings are invalid. Use the snmp-agent local-engineid command to configure a name for a local or remote SNMP engine on the switch. Use the command to Using undo snmp-agent local-engineid command, you can restore the default setting of engine ID. By default, the engine ID is corporation number + device information. Device information is determined according to different products. It can be IP address, MAC address or user defined text. However, you must use numbers in hexadecimal form. # Configure the ID of a local or remote device as System : return to User with Ctrl+Z. [H3C] snmp-agent local-engineid snmp-agent mib-view snmp-agent mib-view { included excluded } view-name oid-tree undo snmp-agent mib-view view-name included: Includes this MIB subtree. excluded: Excludes this MIB subtree. 1-12

14 view-name: Specifies the view name, with a character string, ranging from 1 to 32 characters. oid-tree: MIB object subtree. It can be a character string of the variable OID, or a variable name, ranging from 1 to 255 characters. By default, OID is Use the snmp-agent mib-view command to create or update the view information. Use the undo snmp-agent mib-view command to cancel the view information By default, the view name is Default. OID is This command supports the parameter input of both OID and node name. Related commands: snmp-agent group. # Create a view that consists of all the objects of MIB-II. System : return to User with Ctrl+Z. [H3C] snmp-agent mib-view included mib snmp-agent packet max-size snmp-agent packet max-size byte-count undo snmp-agent packet max-size byte-count: Specifies the size of SNMP packet (measured in bytes), ranging from 484 to By default, the size is 2000 bytes. Use the snmp-agent packet max-size command to configure the size of SNMP packet that the Agent can send/receive. Use the undo snmp-agent packet max-size command to restore the default size of SNMP packet. The sizes of the SNMP packets received/sent by the Agent are different in different network environment. 1-13

15 # Set the size of SNMP packet to 1042 bytes. System : return to User with Ctrl+Z. [H3C] snmp-agent packet max-size snmp-agent sys-info snmp-agent sys-info { contact syscontact location syslocation version { { v1 v2c v3 } * all } } undo snmp-agent sys-info { { contact location }* version { { v1 v2c v3 } * all } } contact: The contact information for system maintenance. syscontact: Characters describe the contact information for system maintenance. location: Sets the geographical location of the device. syslocation: Geographical location of the device. version: version of running SNMP. v1: SNMPv1. v2c: SNMPv2c. v3: SNMPv3. *: Indicates that you can select more than one item from the three options v1, v2c, and v3. Here, you must select at least one option, and you can select all the three options. all: all SNMP version (includes SNMPv1, SNMPv2c, SNMPv3). Use the snmp-agent sys-info command to configure system information such as geographical location of the device, contact information for system maintenance and version information of running SNMP. Use the undo snmp-agent sys-info location command to restore the default value. By default, the contact information for system maintenance is " Hangzhou H3C Technologies Co., Ltd.", the system information about geographical location is " Hangzhou, China", and the version information is " SNMPv1, SNMPv2c, and SNMPv3". 1-14

16 Related commands: display snmp-agent sys-info. # Set the system maintenance information to "Dial System Operator at beeper # 27345". System : return to User with Ctrl+Z. [H3C] snmp-agent sys-info contact Dial System Operator at beeper # snmp-agent target-host snmp-agent target-host trap address udp-domain host-addr [ udp-port udp-port-number ] params securityname securityname [ v1 v2c v3 [ authentication privacy ] ] undo snmp-agent target-host host-addr securityname securityname address: Specifies the address of the host which receives SNMP messages. host-addr: IP address of the host. udp-port udp-port-number: Specifies the UDP port number of the host to receive the SNMP notification. v1: Represent the version of SNMPv1. v2c: Represent the version of SNMPv2c. v3: Represent the version of SNMPv3. securityname: Specifies the community name, in the range 1 to 32 bytes. It can be the community name of SNMPv1/v2c or the user name of SNMPv3. authentication: Configures to authenticate the packet without encryption. privacy: Configures to authenticate and encrypt the packet. Use the snmp-agent target-host command to configure destination of SNMP notification. Use the undo snmp-agent target-host command to cancel the host that receives SNMP notification. 1-15

17 The snmp-agent target-host command and the snmp-agent trap enable command should be used at the same time. Use the snmp-agent trap enable command to enable the device to transmit trap messages. The snmp-agent trap enable command and snmp-agent target-host command should be used at the same time on the host to enable notify message sending. Note: If the version of SNMP message is v3, the packet authentication encryption mode specified by the command must be consistent with configuration for SNMP group to which the securityname belongs. Related commands: snmp-agent trap enable, snmp-agent trap source, snmp-agent trap life, snmp-agent group, snmp-agent usm-user. # Enable sending trap message to with community name public. System : return to User with Ctrl+Z. [H3C] snmp-agent trap enable [H3C] snmp-agent target-host trap address udp-domain params securityname public snmp-agent trap enable snmp-agent trap enable [ bgp [ backwardtransition established ]* configuration flash ospf [ process-id ] [ ospf-trap-list ] protect-switch pw ldp lsp mpls-oam standard [ authentication coldstart linkdown linkup warmstart ]* system vrrp [ authfailure newmaster ] ] undo snmp-agent trap enable [ bgp [ backwardtransition established ]* configuration flash ospf [ process-id ] [ ospf-trap-list ] protect-switch pw ldp lsp mpls-oam standard [ authentication coldstart linkdown linkup warmstart ]* system vrrp [ authfailure newmaster ] ] 1-16

18 standard [ authentication ] [ coldstart ] [ linkdown ] [ linkup ]: Enables the sending of standard trap messages. authentication: Enables the sending of SNMP authentication trap messages. coldstart: Enables the sending of SNMP cold start trap messages. linkdown: Enables the sending of SNMP link down trap messages. linkup: Enables the sending of SNMP link up trap messages. warmstart: Enables the sending of SNMP hot start trap messages. bgp [ backwardtransition ] [ established ] : Enables the sending of BGP trap messages. ospf [ process-id ] [ ospf-trap-list ]: Enables the sending of OSPF trap messages. pw: Enables the sending of trap messages about Martini VLL PW state. mpls-oam: Enables the sending of trap messages about MPLS-OAM. protect-switch: Enables the sending of trap messages about protect-switch state. configuration: Enables the sending of configuration management trap messages. flash: Enables the sending of FLASH trap messages. system: Enables the sending of system management MIB trap messages. vrrp [ authfailure newmaster ]: Enables the sending of VRRP trap messages. ldp: Enables the sending of LDP trap messages. lsp: Enables the sending of LSP trap messages. Use the snmp-agent trap enable command to enable the sending of trap messages. Use the undo snmp-agent trap enable command to disable the sending of trap messages. By default, trap message sending is disabled. The snmp-agent trap enable command and snmp-agent target-host command should be used at the same time. The snmp-agent target-host command specifies which hosts can receive trap message. However, to send trap message, at least one snmp-agent target-host command should be configured. 1-17

19 Note: After you enable the device to send trap messages of a specific event using the snmp-agent trap enable command, the corresponding trap alarms will be sent to the SNMP users when the event occurs. # Enable the sending of the trap message of SNMP authentication failure to The community name is public. System : return to User with Ctrl+Z. [H3C] snmp-agent trap enable standard authentication [H3C] snmp-agent target-host trap address udp-domain params securityname public snmp-agent trap if-mib link extended snmp-agent trap ifmib link extended undo snmp-agent trap ifmib link extended None Use the snmp-agent trap ifmib link extended command to configure a link up/down trap to carry the interface type and interface number besides the parameters defined in the standard MIB when the trap is sent. Use the undo snmp-agent trap if-mib link extended command to restore the default. By default, a link up/down trap carries only the parameters defined in the standard MIB. # Configure a link up/down trap to carry the interface type and interface number besides the parameters defined in the standard MIB when the trap is sent. System : return to User with Ctrl+Z. 1-18

20 [H3C] snmp-agent trap ifmib link extended snmp-agent trap life snmp-agent trap life seconds undo snmp-agent trap life seconds: Specifies the time for keeping trap messages, in the range 1 to 2,592,000 seconds; By default, the time for keeping trap messages is 120 seconds. Use the snmp-agent trap life command to configure the timeout of trap messages. Use the undo snmp-agent trap life command to restore the default value. The set timeout of trap message is represented by seconds. If time exceeds seconds, this trap message will be discarded. Related commands: snmp-agent trap enable, snmp-agent target-host. # Configure the time for keeping trap messages as 60 seconds. System : return to User with Ctrl+Z. [H3C] snmp-agent trap life snmp-agent trap queue-size snmp-agent trap queue-size length undo snmp-agent trap queue-size length: Length of queue, ranging from 1 to 1,000. By default, the length is

21 Use the snmp-agent trap queue-size command to configure the information queue length of trap message sent to Destination Host. Use the undo snmp-agent trap queue-size command to restore the default value. Related commands: snmp-agent trap enable, snmp-agent target-host, snmp-agent trap life. # Configure the queue length as 200. System : return to User with Ctrl+Z. [H3C] snmp-agent trap queue-size snmp-agent trap source snmp-agent trap source interface vlan-id-type interface-number undo snmp-agent trap source interface-type: Specifies an interface by its type. interface-number: Specifies an interface by its number. Use the snmp-agent trap source command to configure the source address for sending trap. Use the undo snmp-agent trap source command to cancel the source address for sending trap. You can use this command to configure to track specific event by using the trap address. # Configure the IP address of the VLAN interface 1 as the source address for transmitting the trap messages. System : return to User with Ctrl+Z. [H3C] snmp-agent trap source vlan-interface

22 snmp-agent usm-user snmp-agent usm-user { v1 v2c } username groupname [ acl acl-list ] undo snmp-agent usm-user { v1 v2c } username groupname snmp-agent usm-user v3 username groupname [ authentication-mode { md5 sha } authpassstring [ privacy-mode { des56 privpassstring } ] ] [ acl acl-list ] undo snmp-agent usm-user v3 username groupname { local engineid engine-id } v1: Configures to use v1 safe mode. v2c: Configures to use v2c safe mode. v3: Configures to use v3 safe mode. username: Specifies the user name, ranging from 1 to 32 characters. groupname: Specifies the group name corresponding to that user, a string of 1 to 32 characters. authentication-mode: Specifies the safety level as authentication required. md5: MD5 algorithm is adopted in authentication. MD5 authentication uses the 128-digit password. Computation speed of MD5 is faster than that of SHA sha: SHA algorithm is adopted in authentication. SHA authentication uses the 160-digit password. Computation speed of SHA is slower than that of MD5, but with higher security. authpasstring: Specifies the authentication password, a string of 1 to 64 characters. privacy-mode: Specifies the safety level as encrypted. des56: Specifies the authentication protocol as DES. privpassword: Specifies the encryption password, a string of 1 to 64 characters. acl acl-list: Sets access control list for this user based on USM name engineid engine-id: SNMP engineid. Use the snmp-agent usm-user command to add a new user to an SNMP group. Use the undo snmp-agent usm-user command to cancel a user from SNMP group. SNMP engineid (for authentication) is required when configuring remote user for an agent. This command will not be effective without engineid configured. 1-21

23 For SNMPv1 and SNMPv2c, this command will add a new community name. For SNMPv3, it will add a new user for an SNMP group. # Add a user wang for test (an SNMP group), configures to authenticate with MD5 and sets authentication password as pass. System : return to User with Ctrl+Z. [H3C] snmp-agent usm-user v3 wang test authentication-mode md5 pass undo snmp-agent undo snmp-agent None Use the undo snmp-agent command to disable all versions of SNMP running on the server. Perform any command of snmp-agent will enable SNMP Agent. # Disable the running SNMP agents of all SNMP versions. System : return to User with Ctrl+Z. [H3C] undo snmp-agent 1-22