-
CSS Basic Configuration Guide (Software Version 5.00)
-
Content Services Switch Basic Configuration Guide Index (Software Version 5.00)
-
About This Guide
-
Logging in and Getting Started
-
Configuring User Profiles and CSS Parameters
-
Configuring CSS Network Protocols
-
Configuring Interfaces and Circuits
-
Configuring Services
-
Configuring Owners
-
Configuring Content Rules
-
Using the CSS Logging Features
-
Configuring Simple Network Management Protocol (SNMP)
-
Configuring Remote Monitoring (RMON)
-
Upgrading Your CSS Software
-
Table Of Contents
Configuring Simple Network Management Protocol (SNMP)
Management Information Base (MIB)
MIB Extensions (Enterprise MIBs)
Controlling SNMP Access to the CSS
Planning Your SNMP Configuration
Defining the CSS as an SNMP Agent
Configuring SNMP Generic Traps
Configuring SNMP Enterprise Traps
Configuring SNMP Reload-Enable
Configuring Denial of Service (DoS)
Displaying the SNMP Configuration
Enabling SNMP Manager Access to the CSS
Using the CSS to Look Up MIB Objects
Configuring Simple Network Management Protocol (SNMP)
This chapter provides information on configuring Simple Network Management Protocol (SNMP) features on your CSS. It also provides a brief overview of SNMP, an Application Layer protocol used extensively in the communications industry. Information in this chapter applies to all CSS models except where noted.
This chapter includes the following sections:
•
Displaying the SNMP Configuration
SNMP Overview
Simple Network Management Protocol (SNMP) is a set of network management standards for IP-based internetworks. It includes a protocol, a database-structure specification, and a set of management data objects. SNMP implementations typically consist of a management application, running on one or more Network Management Systems (NMSs), and agent applications, usually executing in firmware on various network devices.
SNMP has two major standard revisions, SNMPv1 and SNMPv2. Your CSS supports SNMPv2C (SNMP version 2C), known as "community-based SNMP", and standard Management Information Base (MIB-II) objects, along with an extensive set of enterprise objects. (MIBs are discussed later in this chapter in the section "Management Information Base (MIB)".)
This overview contains the following sections:
•
Note
Managers and Agents
SNMP uses software entities called managers and agents to manage network devices:
•
•
There are many different SNMP management applications, but they all perform the same basic task: they allow SNMP managers to communicate with agents to monitor, configure, and receive alerts from the network devices. You can use any SNMP-compatible network management system to monitor and control a CSS.
Manager/Agent Communication
There are several ways that the SNMP manager and the agent communicate.
•
–
The SNMP manager requests information from the agent, such as the number of users logged on to the agent device, or the status of a critical process on that device. The agent gets the value of the requested MIB variable and sends the value back to the manager.
–
The SNMP manager retrieves values from within a MIB. Using the get-next function, you do not need to know the exact variable instance you are looking for; the SNMP manager takes the variable you name and then uses a sequential search to find the desired variables.
–
The SNMP manager performs a number of get-next actions that you specify.
–
The SNMP manager requests the agent to change the value of the MIB variable. For example, you could run a script or an application on a remote device with a set action.
•
When a trap condition occurs, the SNMP agent sends an SNMP trap message to the device specified as the trap receiver or trap host. The SNMP Administrator configures the trap host (usually the SNMP management station) to perform the action needed when a trap is detected. illustrates manager/agent communication.
Figure 9-1 SNMP Manager/Agent Interaction
Management Information Base (MIB)
SNMP obtains information from the network through a Management Information Base (MIB). The MIB is a database of code blocks called MIB objects. Each MIB object controls one specific function, such as counting how many bytes are transmitted through an agent's port. The MIB object comprises MIB variables, which define the MIB object name, description, default value, and so forth.
The collection of MIB objects is structured hierarchically. The MIB hierarchy is referred to as the MIB tree. The MIB tree is defined by the International Standards Organization (ISO). The MIB is installed on the manager, and is present within each agent in the SNMP network.
At the top of the tree is the broadest information about a network. Each branch and sub-branch of the tree gets progressively more specific, and the lowest branches of the tree contain the most specific MIB objects; the leaves contain the actual data. See for an example of how the MIB tree objects become more specific as the tree expands.
Note
MIB Variables
There are two types of MIB variables:
•
•
Figure 9-2 Top of the MIB Tree
As shown in , a number is associated with a MIB object name. This number is called the object identifier (or object ID), and it uniquely identifies the MIB object in the MIB tree. (The dotted lines represent other branches not relevant to this discussion.)
For example, the MIB object labeled arrowpoint (which contains the MIB objects specific to CSSs) in can be labeled:
iso.organization.dod.internet.private.enterprises.arrowpointor
1.3.6.1.4.1.2467MIB Extensions (Enterprise MIBs)
The MIB tree has a special branch set aside for specific vendors to build their own extensions; this is called the enterprise MIB branch. The MIB files in this branch, included on your CSS Documentation and System Software CD, comprise the CSS Enterprise MIBs. (This is the highlighted MIB object in .) The enterprise MIB files are categorized along functional boundaries.
For a list of MIB branches under the Cisco CSS Enterprise MIB, refer to
Table 9-5 later in this chapter.SNMP Communities
Each SNMP device or member is part of a community. An SNMP community determines the access that each SNMP device has.
You supply a name to the community. After that, all SNMP devices that are assigned to that community as members have the same access rights. The access rights that the CSS supports are:
•
•
Configuring SNMP on the CSS
Once you have set up the SNMP management software (SNMP version 2C) on the network devices, you are ready to configure SNMP settings on the CSS. You can configure two basic areas of SNMP functionality on the CSS: SNMP functions and RMON functions.
The following sections describe how to configure SNMP on the CSS. For information on configuring RMON, refer to Chapter 10, Configuring Remote Monitoring (RMON).
•
•
•
•
Controlling SNMP Access to the CSS
To control SNMP access to the CSS, use the no restrict snmp and restrict snmp commands. Access through SNMP is enabled by default. The options for this global configuration mode command are:
•
•
Planning Your SNMP Configuration
Consider the following information before you set up SNMP on your network:
•
•
•
Defining the CSS as an SNMP Agent
The following sections describe how to define the CSS as an SNMP agent. Read these sections for a complete description of the commands associated with this procedure. If you are familiar with this procedure, refer to Table 9-1 as a quick start configuration reference for this task.
•
•
•
•
•
Configuring an SNMP Community
Use the snmp community command to set or modify SNMP community names and access properties. You may specify as many community names as you wish.
Caution
The syntax for this global configuration mode command is:
snmp community community_name [read-only|read-write]
The variables and options are:
•
•
•
For example:
(config)# snmp community sqa read-writeTo remove a community name, enter:
(config)# no snmp community sqaConfiguring an SNMP Contact
Use the snmp contact command to set or modify the contact name for the SNMP system. You can specify only one contact name. The syntax for this global configuration mode command is:
snmp contact "contact_name"
Enter the contact name as an unquoted text string with a maximum of 255 characters including spaces. You can also include information on how to contact the person; for example, a phone number or email address.
For example:
(config)# snmp contact "Fred N. Mandy"To remove the contact name, enter:
(config)# no snmp contactConfiguring an SNMP Location
Use the snmp location command to set or modify the SNMP system location. You can specify only one location. The syntax for this global configuration mode command is:
snmp location "location"
Enter the location as the physical location of the system. Enter a quoted text string with a maximum length of 255 characters.
For example:
(config)# snmp location "sqa_lab1"To remove the location, enter:
(config)# no snmp locationConfiguring an SNMP Name
Use the snmp name command to set or modify the SNMP name for this system. You can specify only one name. The syntax for this global configuration mode command is:
snmp name "name"
Enter the SNMP name as the unique name assigned to a system by the administrator. Enter a quoted text string with a maximum of 255 characters. The standard name convention is the system's fully-qualified domain name (for example, sqa@arrowpoint.com).
For example:
(config)# snmp name "sqa@arrowpoint.com"To remove the SNMP name for a system, enter:
(config)# no snmp nameConfiguring SNMP Generic Traps
Use the snmp trap-type generic command to enable SNMP generic trap types. The generic SNMP traps consist of cold start, warm start, link down, and link up.
For example:
(config)# snmp trap-type genericTo disable a generic trap, enter:
(config)# no snmp trap-type genericConfiguring an SNMP Trap-Host
Use the snmp trap-host command to set or modify the SNMP host to receive traps from a CSS. You can specify a maximum of five hosts. The syntax for this global configuration mode command is:
snmp trap-host ip_address or host community_name
The variables are:
•
•
For example:
(config)# snmp trap-host 172.16.3.6 sqa@arrowpoint.comTo remove a specified trap host, enter:
(config)# no snmp trap-host 172.16.3.6Configuring SNMP Auth-Traps
Use the snmp auth-traps command to enable reception of SNMP authentication traps. The CSS generates these traps when an SNMP management station attempts to access your system with invalid community names.
For example:
(config)# snmp auth-trapsTo disable reception of authentication traps, enter:
(config)# no snmp auth-trapsConfiguring SNMP Enterprise Traps
Use the snmp trap-type enterprise command to enable SNMP enterprise trap types. You can enable the CSS to generate enterprise traps when denial of service attack events occur, a login fails, or a CSS service transitions state.
Note
The options for this global configuration mode command are:
•
•
•
•
•
For example, to enable enterprise traps, enter:
(config)# snmp trap-type enterpriseTo disable all enterprise traps, enter:
(config)# no snmp trap-type enterpriseTo prevent the CSS from generating traps when a login fails, enter:
(config)# no snmp trap-type enterprise login-failureTo prevent the CSS from generating traps when a CSS reload occurs, enter:
(config)# no snmp trap-type enterprise reloadTo prevent the CSS from generating traps when the service transitions state, enter:
(config)# no snmp trap-type enterprise service-transitionTo prevent the CSS from generating traps when a redundant CSS transitions state, enter:
(config)# no snmp trap-type enterprise redundancy-transitionConfiguring SNMP Reload-Enable
Use the snmp reload-enable command to reboot the CSS using SNMP. The syntax and options for this global configuration mode command are:
•
•
Enter the reload_value as the object used to control apSnmpExtReloadSet, providing the SNMP-based reboot. When the object is set to 0, an SNMP reboot is not allowed. When the object is set between 1 to 232, a reboot may be caused with any write value to apSnmpExtReloadSet. For security purposes, this object always returns 0 when read.
For example:
(config)# snmp reload-enableTo prevent users from rebooting the CSS using SNMP (default behavior), enter:
(config)# no snmp reload-enableConfiguring Denial of Service (DoS)
You can configure special enterprise traps to notify the trap host of Denial of Service (DoS) attacks on your system. You can also use the CLI to display detailed information about DoS attacks and reset the DoS statistics for your CSS to zero. This section describes how to configure DoS traps. If you are familiar with this procedure, use Table 9-2 as a quick start configuration reference.
Note
Defining a DoS SNMP Trap-Type
Use the snmp trap-type enterprise command to enable the CSS to generate SNMP enterprise traps when a denial of service (DoS) attack event occurs. One trap is generated each second when the number of attacks during that second exceeds the threshold for the configured DoS attack type.
Note
The syntax for this global configuration mode command is:
snmp trap-type enterprise dos_attack_type {trap-threshold threshold_value}
The dos_attack_type variable is the type of denial of service attack event to trap. The options are:
•
•
1 per second.•
•
Note
For example, to enable the CSS to generate traps for packets that have identical source and destination addresses, enter:
(config)# snmp trap-type enterprise dos-land-attackFor example, to prevent the CSS from generating denial of service attack event traps, enter:
(config)# no snmp trap-type enterprise dos_attack_typeDisplaying Denial of Service Configurations
Use the show dos summary command to display a summary of information about DoS attacks. To display more detailed information, use the show dos command.
For example:
(config)# show dos summaryTable 9-3 describes the fields in the show dos output.
Displaying the SNMP Configuration
After you configure SNMP, display the SNMP configuration. For example:
(config)# show running-config globalFor details on the show running-config command and its output, refer to Chapter 1, Logging in and Getting Started.
Managing SNMP on the CSS
The main tasks you need to do to manage SNMP on the CSS are:
•
•
Enabling SNMP Manager Access to the CSS
By default, the CSS enables SNMP access to its command base, but you must first create community strings using the snmp community command before you can use SNMP in the CSS. Refer to "Configuring an SNMP Community" earlier in this chapter for details.
Note
Using the CSS to Look Up MIB Objects
To look up a MIB object, including the variables that make up the object:
1.
# config2.
(config)# rmon-alarm index_numberwhere index_number is the index of the alarm.
3.
(config-rmonalarm[1])# lookup objectwhere object is the name of the MIB object.
You can look up a specific object, or you can use the question mark (?) character as a wildcard to help you complete your request.
For example, you want to look up a MIB object, but you are not sure of its exact name. You already know that the MIB you want is part of the apFlowMgrExt group of objects. In this case, issue the lookup command with the question mark (?) character, as shown below.
(config-rmonalarm[1])# lookup apFlowMgrExt?apFlowMgrExtDoSAttackEventTypeapFlowMgrExtDoSAttackEventCountapFlowMgrExtDoSAttackIndexapFlowMgrExtDosTotalSmurfAttacksapFlowMgrExtDosTotalIllegalSourceAttacksapFlowMgrExtDosTotalZeroPortAttacksapFlowMgrExtDosTotalLandAttacksapFlowMgrExtDosTotalSynAttacksapFlowMgrExtDosTotalAttacksapFlowMgrExtIdleTimerapFlowMgrExtPortIdleValueapFlowMgrExtPortIdleapFlowMgrExtReserveCleanTimerapFlowMgrExtPermanentPort4apFlowMgrExtPermanentPort3apFlowMgrExtPermanentPort2apFlowMgrExtPermanentPort1apFlowMgrExtFlowTraceDurationapFlowMgrExtFlowTraceMaxFileSizeapFlowMgrExtFlowTraceStateThe previous example shows that using the question mark (?) character as a wildcard returns information about the apFlowMgrExt MIB object. You can also issue the lookup command on the exact MIB you want and view its description without using the question mark (?) character. For example:
(config-rmonalarm[1])# lookup apFlowMgrExtDOSAttackEventCountASN Name: apFlowMgrExtDOSAttackEventCountMIB: flowmgrextObject Identifer: 1.3.6.1.4.1.2467.1.36.27.1.6Argument Type: IntegerRange: 0-4294967295Description:This is the number of times this DoS attack had occurred.You can also display a list of all the Enterprise MIBs by using the lookup command without any MIB object names, as in the following example:
(config-rmonalarm[1])# lookup ?
Note
Useful MIB Statistics
Table 9-4 contains some of the MIB groups that provide useful statistics.
Reading Logs
The traplog file contains all of the traps, both generic and enterprise, that have occurred. The network device writes to the traplog file whether or not the SNMP trap configuration is enabled.
To show the trap log since the last CSS reboot, issue the show log command as shown:
# show log traplogBy default, the following events generate level critical-2 messages:
•
•
•
•
•
•
All other SNMP traps generate level notice-5 messages by default.
Setting Alarms
For information about commands available in this mode, refer to Chapter 10, Configuring Remote Monitoring (RMON).
CSS MIBs
Table 9-5 describes the CSS MIB objects directly under the CSS Enterprise MIB (1.3.6.1.4.1.2467). The MIBs listed in this table are a representation of the CSS content-specific MIB objects. To find out how you can look up object information, see the section "Using the CSS to Look Up MIB Objects" in this chapter.
