-
Cisco ASA 5500 Series Configuration Guide using ASDM, 6.3
-
About This Guide
-
Glossary
- Getting Started and General Information
- Setting Up the Adaptive Security Appliance
- Configuring Access Lists
- Configuring IP Routing
- Configuring NAT (ASA 8.3 and Later)
- Configuring NAT (ASA 8.2 and Earlier)
- Configuring Service Policies
- Configuring Access Control
- Configuring Application Inspection
-
Configuring Unified Communications
-
Information About Cisco Unified Communications
-
Using the Cisco Unified Communication Wizard
-
Configuring the Cisco Phone Proxy Feature
-
Configuring the TLS Proxy for Encrypted Voice Inspection Feature
-
Configuring the Cisco Unified Mobility Feature
-
Configuring the Cisco Unified Presence Feature
-
Configuring Cisco Unified Communications Intercompany Media Engine
-
- Configuring Connection Settings and QoS
- Configuring Advanced Network Protection
- Configuring Applications on SSMs and SSCs
- Configuring High Availability
- Configuring VPN
- Configuring Logging, SNMP, and Smart Call Home
- System Administration
- Reference
-
Feedback
Table Of Contents
Information About SNMP Terminology
Information About MIBs and Traps
Implementation Differences Between Adaptive Security Appliances and the Cisco IOS
Licensing Requirements for SNMP
Configuring an SNMP Management Station
Compiling Cisco Syslog MIB Files
Application Services and Third-Party Tools
Configuring SNMP
This chapter describes how to configure SNMP to monitor the adaptive security appliance and includes the following sections:
•
Licensing Requirements for SNMP
Information about SNMP
SNMP is an application-layer protocol that facilitates the exchange of management information between network devices. It is part of the TCP/IP protocol suite. This section describes SNMP monitoring, and includes the following topics:
•
•
The adaptive security appliance provides support for network monitoring using SNMP Versions 1, 2c, and 3, and supports the use of all three versions simultaneously. The SNMP interface lets you monitor the adaptive security appliance through network management systems (NMSs), such as HP OpenView. The adaptive security appliance supports SNMP read-only access through issuance of a GET request. SNMP write access is not allowed, so you cannot make changes with SNMP. In addition, the SNMP SET request is not supported.
You can configure the adaptive security appliance to send traps, which are unsolicited comments from the managed device to the management station for certain events (event notifications) to an NMS, or you can use the NMS to browse the MIBs on the adaptive security appliance. MIBs are a collection of definitions, and the adaptive security appliance maintains a database of values for each definition. Browsing a MIB means issuing a series of GET-NEXT or GET-BULK requests of the MIB tree from the NMS to determine values.
The adaptive security appliance has an SNMP agent that notifies designated management stations if events occur that are pre-defined to require a notification, for example, when a link in the network goes up or down. The notification it sends includes an SNMP OID, which identifies itself to the management stations. The adaptive security appliance SNMP agent also replies when a management station asks for information.
Information About SNMP Terminology
Table 74-1 lists the terms that are commonly used when working with SNMP:
Information About MIBs and Traps
MIBs are either standard or enterprise-specific. Standard MIBs are created by the IETF and documented in various RFCs. A trap reports significant events occurring on a network device, most often errors or failures. SNMP traps are defined in either standard or enterprise-specific MIBs. Standard traps are created by the IETF and documented in various RFCs. Standard traps are compiled into the adaptive security appliance software.
If needed, you can also download RFCs, standard MIBs, and standard traps from the IETF website:
Download Cisco MIBs and OIDs from the following location:
http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml
Download Cisco OIDs from the following location:
ftp://ftp.cisco.com/pub/mibs/oid/oid.tar.gz
Note
SNMP Version 3
This section describes SNMP Version 3 and includes the following topics:
•
SNMP Version 3 Overview
SNMP Version 3 provides security enhancements that are not available in SNMP Version 1 or SNMP Version 2c. SNMP Versions 1 and 2c transmit data between the SNMP server and SNMP agent in clear text. SNMP Version 3 adds authentication and privacy options to secure protocol operations. In addition, this version controls access to the SNMP agent and MIB objects through the User-based Security Model (USM) and View-based Access Control Model (VACM). The ASA 5500 series adaptive security appliances also support the creation of SNMP groups and users, as well as hosts, which is required to enable transport authentication and encryption for secure SNMP communications.
Security Models
For configuration purposes, the authentication and privacy options are grouped together into security models. Security models apply to users and groups, which are divided into the following three types:
•
•
•
SNMP Groups
An SNMP group is an access control policy to which users can be added. Each SNMP group is configured with a security model, and is associated with an SNMP view. A user within an SNMP group must match the security model of the SNMP group. These parameters specify what type of authentication and privacy a user within an SNMP group uses. Each SNMP group name and security model pair must be unique.
SNMP Users
SNMP users have a specified username, a group to which the user belongs, authentication password, encryption password, and authentication and encryption algorithms to use. The authentication algorithm options are MD5 and SHA. The encryption algorithm options are DES, 3DES, and AES (which is available in 128, 192, and 256 versions). When you create a user, you must associate it with an SNMP group. The user then inherits the security model of the group.
SNMP Hosts
An SNMP host is an IP address to which SNMP notifications and traps are sent. To configure SNMP Version 3 hosts, along with the target IP address, you must configure a username, because traps are only sent to a configured user. SNMP target IP addresses and target parameter names must be unique on the adaptive security appliance. Each SNMP host can have only one username associated with it. To receive SNMP traps, configure the SNMP NMS, and make sure that you configure the user credentials on the NMS to match those configured on the adaptive security appliance.
Implementation Differences Between Adaptive Security Appliances and the Cisco IOS
The SNMP Version 3 implementation in adaptive security appliances differs from the SNMP Version 3 implementation in the Cisco IOS in the following ways:
•
•
•
•
•
•
Licensing Requirements for SNMP
The following table shows the licensing requirements for this feature:
Prerequisites for SNMP
SNMP has the following prerequisite:
You must have Cisco Works for Windows or another SNMP MIB-II compliant browser to receive SNMP traps or browse a MIB.
Guidelines and Limitations
Context Mode Guidelines
Supported in single and multiple context modes.
Firewall Mode Guidelines
Supported in routed and transparent firewall modes.
Failover Guidelines
•
•
IPv6 Guidelines
Does not support IPv6.
Additional Guidelines
•
•
•
•
•
•
•
•
–
–
–
•
•
Configuring SNMP
This section describes how to configure SNMP and includes the following topics:
•
•
Enabling SNMP
The SNMP agent that runs on the adaptive security appliance performs two functions:
•
•
To enable the SNMP agent and identify an NMS that can connect to the SNMP server, see the following pane:
Configuration > Device Management > Management Access > SNMP
Ensures that the SNMP server on the adaptive security appliance is enabled. By default, the SNMP server is enabled.
What to Do Next
See the "Configuring an SNMP Management Station" section.
Configuring an SNMP Management Station
To receive requests from the adaptive security appliance. you must configure an SNMP management station in ASDM.
To configure an SNMP management station, perform the following steps:
Step 1
Step 2
The Add SNMP Host Access Entry dialog box appears.
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
Step 10
The Add SNMP Host Access Entry dialog box closes.
Step 11
The NMS is configured and changes are saved to the running configuration. For more information about SNMP Version 3 NMS tools, go to the following URL:
http://www.cisco.com/en/US/docs/security/asa/asa82/snmp/snmpv3_tools.html
What to Do Next
See the "Configuring SNMP Traps" section.
Configuring SNMP Traps
To designate which traps the SNMP agent generates and how they are collected and sent to NMSs, perform the following steps:
Step 1
Step 2
The SNMP Trap Configuration dialog box appears.
Step 3
Step 4
The SNMP Trap Configuration dialog box closes.
Step 5
The SNMP traps are configured and the changes are saved to the running configuration.
What to Do Next
See the "Compiling Cisco Syslog MIB Files" section.
Compiling Cisco Syslog MIB Files
To receive security and failover SNMP traps from the adaptive security appliance, compile the Cisco SMI MIB and the Cisco Syslog MIB into the SNMP management application. If you do not compile the Cisco Syslog MIB into your application, you only receive traps for linkup or linkdown, coldstart, and authentication failure.
To compile Cisco Syslog MIB files into your browser using Cisco Works for Windows, perform the following steps:
Step 1
http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml
Step 2
The Adaptive Security Appliance MIB Support List appears.
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Note
Step 9
Step 10
Step 11
Step 12
Step 13
Step 14
Step 15
Step 16
Step 17
Step 18
Step 19
Step 20
What to Do Next
Choose one of the following:
•
•
Using SNMP Version 1 or 2c
To configure parameters for SNMP Version 1 or 2c, perform the following steps:
Step 1
Step 2
Enter the password used by the SNMP NMSs when sending requests to the adaptive security appliance. The SNMP community string is a shared secret among the SNMP NMSs and the network nodes being managed. The adaptive security appliance uses the password to determine if the incoming SNMP request is valid. The password is a case-sensitive value up to 32 characters in length. Spaces are not permitted. The default is "public." SNMP Version 2c allows separate community strings to be set for each NMS. If no community string is configured for any NMS, the value set here will be used by default.
Step 3
Step 4
Step 5
Step 6
SNMP parameters for Versions 1 and 2c are configured and the changes are saved to the running configuration.
What to Do Next
See the "Monitoring SNMP" section.
Using SNMP Version 3
To configure parameters for SNMP Version 3, perform the following steps:
Step 1
Step 2
Note
The Add SNMP User Entry dialog box appears.
Step 3
•
•
•
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
Step 10
Step 11
The Add SNMP User Entry dialog box closes.
The SNMPv3 Users pane lists the following information: SNMP Version 3 server group name, name of the user that belongs to the specified group, encrypted password setting, authentication setting, encryption algorithm setting, and the AES size setting.
Step 12
SNMP parameters for Version 3 are configured, and the changes are saved to the running configuration.
What to Do Next
See the "Monitoring SNMP" section.
Monitoring SNMP
NMSs are the PCs or workstations that you set up to monitor SNMP events and manage devices, such as the adaptive security appliance.You can monitor the health of a device from an NMS by polling required information from the SNMP agent that has been set up on the device. Predefined events from the SNMP agent to the NMS generate syslog messages. This section includes the following topics:
SNMP Syslog Messaging
SNMP generates detailed syslog messages numbered 212nnn. Syslog messages indicate the status of SNMP requests, SNMP traps, SNMP channels, and SNMP responses from the adaptive security appliance to a specified host on a specified interface.
For detailed information about syslog messages, see Cisco ASA 5500 Series System Log Messages.
Note
SNMP Monitoring
To monitor SNMP, perform the following steps:
Where to Go Next
To configure the syslog server, see Chapter 72 "Configuring Logging."
Additional References
For additional information related to implementing SNMP, see the following sections:
•
•
RFCs for SNMP Version 3
MIBs
For a list of supported MIBs and traps for the adaptive security appliance by release, see the following URL:
http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml
To obtain a list of the supported SNMP MIBs for a specific adaptive security appliance, choose Tools > Command Line Interface, type the following command, then click Send:
hostname(config)# show snmp-server oidlist
Note
The following is sample output from the show snmp-server oidlist command:
[0] 1.3.6.1.2.1.1.1. sysDescr[1] 1.3.6.1.2.1.1.2. sysObjectID[2] 1.3.6.1.2.1.1.3. sysUpTime[3] 1.3.6.1.2.1.1.4. sysContact[4] 1.3.6.1.2.1.1.5. sysName[5] 1.3.6.1.2.1.1.6. sysLocation[6] 1.3.6.1.2.1.1.7. sysServices[7] 1.3.6.1.2.1.2.1. ifNumber[8] 1.3.6.1.2.1.2.2.1.1. ifIndex[9] 1.3.6.1.2.1.2.2.1.2. ifDescr[10] 1.3.6.1.2.1.2.2.1.3. ifType[11] 1.3.6.1.2.1.2.2.1.4. ifMtu[12] 1.3.6.1.2.1.2.2.1.5. ifSpeed[13] 1.3.6.1.2.1.2.2.1.6. ifPhysAddress[14] 1.3.6.1.2.1.2.2.1.7. ifAdminStatus[15] 1.3.6.1.2.1.2.2.1.8. ifOperStatus[16] 1.3.6.1.2.1.2.2.1.9. ifLastChange[17] 1.3.6.1.2.1.2.2.1.10. ifInOctets[18] 1.3.6.1.2.1.2.2.1.11. ifInUcastPkts[19] 1.3.6.1.2.1.2.2.1.12. ifInNUcastPkts[20] 1.3.6.1.2.1.2.2.1.13. ifInDiscards[21] 1.3.6.1.2.1.2.2.1.14. ifInErrors[22] 1.3.6.1.2.1.2.2.1.16. ifOutOctets[23] 1.3.6.1.2.1.2.2.1.17. ifOutUcastPkts[24] 1.3.6.1.2.1.2.2.1.18. ifOutNUcastPkts[25] 1.3.6.1.2.1.2.2.1.19. ifOutDiscards[26] 1.3.6.1.2.1.2.2.1.20. ifOutErrors[27] 1.3.6.1.2.1.2.2.1.21. ifOutQLen[28] 1.3.6.1.2.1.2.2.1.22. ifSpecific[29] 1.3.6.1.2.1.4.1. ipForwarding[30] 1.3.6.1.2.1.4.20.1.1. ipAdEntAddr[31] 1.3.6.1.2.1.4.20.1.2. ipAdEntIfIndex[32] 1.3.6.1.2.1.4.20.1.3. ipAdEntNetMask[33] 1.3.6.1.2.1.4.20.1.4. ipAdEntBcastAddr[34] 1.3.6.1.2.1.4.20.1.5. ipAdEntReasmMaxSize[35] 1.3.6.1.2.1.11.1. snmpInPkts[36] 1.3.6.1.2.1.11.2. snmpOutPkts[37] 1.3.6.1.2.1.11.3. snmpInBadVersions[38] 1.3.6.1.2.1.11.4. snmpInBadCommunityNames[39] 1.3.6.1.2.1.11.5. snmpInBadCommunityUses[40] 1.3.6.1.2.1.11.6. snmpInASNParseErrs[41] 1.3.6.1.2.1.11.8. snmpInTooBigs[42] 1.3.6.1.2.1.11.9. snmpInNoSuchNames[43] 1.3.6.1.2.1.11.10. snmpInBadValues[44] 1.3.6.1.2.1.11.11. snmpInReadOnlys[45] 1.3.6.1.2.1.11.12. snmpInGenErrs[46] 1.3.6.1.2.1.11.13. snmpInTotalReqVars[47] 1.3.6.1.2.1.11.14. snmpInTotalSetVars[48] 1.3.6.1.2.1.11.15. snmpInGetRequests[49] 1.3.6.1.2.1.11.16. snmpInGetNexts[50] 1.3.6.1.2.1.11.17. snmpInSetRequests[51] 1.3.6.1.2.1.11.18. snmpInGetResponses[52] 1.3.6.1.2.1.11.19. snmpInTraps[53] 1.3.6.1.2.1.11.20. snmpOutTooBigs[54] 1.3.6.1.2.1.11.21. snmpOutNoSuchNames[55] 1.3.6.1.2.1.11.22. snmpOutBadValues[56] 1.3.6.1.2.1.11.24. snmpOutGenErrs[57] 1.3.6.1.2.1.11.25. snmpOutGetRequests[58] 1.3.6.1.2.1.11.26. snmpOutGetNexts[59] 1.3.6.1.2.1.11.27. snmpOutSetRequests[60] 1.3.6.1.2.1.11.28. snmpOutGetResponses[61] 1.3.6.1.2.1.11.29. snmpOutTraps[62] 1.3.6.1.2.1.11.30. snmpEnableAuthenTraps[63] 1.3.6.1.2.1.11.31. snmpSilentDrops[64] 1.3.6.1.2.1.11.32. snmpProxyDrops[65] 1.3.6.1.2.1.31.1.1.1.1. ifName[66] 1.3.6.1.2.1.31.1.1.1.2. ifInMulticastPkts[67] 1.3.6.1.2.1.31.1.1.1.3. ifInBroadcastPkts[68] 1.3.6.1.2.1.31.1.1.1.4. ifOutMulticastPkts[69] 1.3.6.1.2.1.31.1.1.1.5. ifOutBroadcastPkts[70] 1.3.6.1.2.1.31.1.1.1.6. ifHCInOctets--More--Application Services and Third-Party Tools
For information about SNMP support, see the following URL:
http://www.cisco.com/en/US/tech/tk648/tk362/tk605/tsd_technology_support_sub-protocol_home.html
For information about using third-party tools to walk SNMP Version 3 MIBs, see the following URL:
http://www.cisco.com/en/US/docs/security/asa/asa83/snmp/snmpv3_tools.html
Feature History for SNMP
Table 74-2 lists each feature change and the platform release in which it was implemented. ASDM is backwards-compatible with multiple platform releases, so the specific ASDM release in which support was added is not listed.
