Introduction
This document describes how to troubleshoot and configure a Cisco Nexus Switch using SNMP
Background
Configuration of a Nexus switch can be modified if SNMP access is available
It is applicable for all Nexus platforms.
Components used
Nexus 5000 switch running version 5.1(3)
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.
Access recovery using SNMP
Device has a L3 interface (other than Mgmt 0) in default vrf
TFTP server should be accessible from this switch via default vrf and authentication disabled on TFTF server
Nexus device should be configured with SNMPv2 read-write community or V3 user
AAA authroization must be disabled
Following switch config
Switch config onctains an ACL applied prevents accessing the device
N5K(config)# sh run int mgmt0
version 5.1(3)N2(1)
interface mgmt0
description “Testing with snmpv3"
ip access-group filter_internal_snmp_i in
vrf member management
ip address10.22.65.39/25
Step 1 - Create a config file with the commands to change or roll back in the running config of Nexus switch:
Following example shows content of the config file for removing an ACL applied on the Mgmt 0 port
interface mgmt0
no ip access-group filter_internal_snmp_i in
Another example to reset the AAA settings to local authentication on the device
aaa authentication login local
Step 2 - Save the file with.config extension and place it inside the boot or home directory of the TFTP application
Step 3 - Perform an SNMP walk to the device to confirm reachability and its accessibility via SNMP
$ ./snmpwalk -v2c -c <SNMPv2 RW communitiy><switch_ip> 1.3.6.1.4.1.9.9.96.1.1.1.1.10.222
Step 4 - Run the following commandsfrom snmp-server (the highlighted ones need to be replaced by actual values)
Using snmp v2
$ snmpset -v2c -c <SNMPv2 RW communitiy><switch_ip> 1.3.6.1.4.1.9.9.96.1.1.1.1.14.222 i 5
$ snmpset -v2c -c <SNMPv2 RW communitiy><switch_ip> 1.3.6.1.4.1.9.9.96.1.1.1.1.2.222 i 1
$ snmpset -v2c -c <SNMPv2 RW communitiy><switch_ip> 1.3.6.1.4.1.9.9.96.1.1.1.1.3.222 i 1
$ snmpset -v2c -c <SNMPv2 RW communitiy><switch_ip> 1.3.6.1.4.1.9.9.96.1.1.1.1.4.222 i 4
$ snmpset -v2c -c <SNMPv2 RW communitiy><switch_ip> 1.3.6.1.4.1.9.9.96.1.1.1.1.5.222 a <tftfp_server>
$ snmpset -v2c -c <SNMPv2 RW communitiy><switch_ip> 1.3.6.1.4.1.9.9.96.1.1.1.1.6.222 s <switch.config>
$ snmpset -v2c -c <SNMPv2 RW communitiy><switch_ip> 1.3.6.1.4.1.9.9.96.1.1.1.1.14.222 i 1
$ ./snmpwalk -v2c -c <SNMPv2 RW communitiy><switch_ip> 1.3.6.1.4.1.9.9.96.1.1.1.1.10.222
Using SNMPv3
snmpset -v3 -l authNoPriv -u <SNMPv3 USER> -a MD5 -A <PASSWORD> <SWITCH_IP> .1.3.6.1.4.1.9.9.96.1.1.1.1.14.222 integer 6 ( to destroy any previous row )
snmpset -v3 -l authNoPriv -u <SNMPv3 USER> -a MD5 -A <PASSWORD> <SWITCH_IP> .1.3.6.1.4.1.9.9.96.1.1.1.1.2.222 integer 1 .1.3.6.1.4.1.9.9.96.1.1.1.1.3.222 integer 1 .1.3.6.1.4.1.9.9.96.1.1.1.1.4.222 integer 4 .1.3.6.1.4.1.9.9.96.1.1.1.1.5.222 a <TFTP_SERVER> .1.3.6.1.4.1.9.9.96.1.1.1.1.6.222 s "switch.config" .1.3.6.1.4.1.9.9.96.1.1.1.1.14.222 integer
SNMPv2-SMI::enterprises.9.9.96.1.1.1.1.2.222 = INTEGER: 1
SNMPv2-SMI::enterprises.9.9.96.1.1.1.1.3.222 = INTEGER: 1
SNMPv2-SMI::enterprises.9.9.96.1.1.1.1.4.222 = INTEGER: 4
SNMPv2-SMI::enterprises.9.9.96.1.1.1.1.5.222 = IpAddress: <TFTP_SERVER>
SNMPv2-SMI::enterprises.9.9.96.1.1.1.1.6.222 = STRING: "switch.config"
SNMPv2-SMI::enterprises.9.9.96.1.1.1.1.14.222 = INTEGER: 4
SNMPv3 steps
snmpset -v3 -l authNoPriv -u admin -a MD5 -A ******* 10.22.65.39 .1.3.6.1.4.1.9.9.96.1.1.1.1.14.222 integer 6 ( to destroy any previous row )
snmpset -v3 -l authNoPriv -u admin -a MD5 -A ******* 10.22.65.39 .1.3.6.1.4.1.9.9.96.1.1.1.1.2.222 integer 1 .1.3.6.1.4.1.9.9.96.1.1.1.1.3.222 integer 1 .1.3.6.1.4.1.9.9.96.1.1.1.1.4.222 integer 4 .1.3.6.1.4.1.9.9.96.1.1.1.1.5.222 a 172.18.108.26 .1.3.6.1.4.1.9.9.96.1.1.1.1.6.222 s "switch.config" .1.3.6.1.4.1.9.9.96.1.1.1.1.14.222 integer 4
SNMPv2-SMI::enterprises.9.9.96.1.1.1.1.2.222 = INTEGER: 1
SNMPv2-SMI::enterprises.9.9.96.1.1.1.1.3.222 = INTEGER: 1
SNMPv2-SMI::enterprises.9.9.96.1.1.1.1.4.222 = INTEGER: 4
SNMPv2-SMI::enterprises.9.9.96.1.1.1.1.5.222 = IpAddress: 172.16.1.1
SNMPv2-SMI::enterprises.9.9.96.1.1.1.1.6.222 = STRING: "switch.config"
SNMPv2-SMI::enterprises.9.9.96.1.1.1.1.14.222 = INTEGER: 4
Swicth config after the workaround
N5K-1(config)# sh run int mgmt0
version 5.1(3)N2(1)
interface mgmt0
description “Testing with snmpv3"
vrf member management
ip address 10.22.65.39/25
You can also look at the accounting logs to see if the command were executed. Config change done by SNMP appears as Root user -
N5K-1(config)# sh accounting log
Mon Aug 6 17:07:37 2018:type=start:id=vsh.5777:user=root:cmd
Mon Aug 6 17:07:37 2018:type=update:id=vsh.5777:user=root:cmd=configure terminal ; interface mgmt0 (SUCCESS)
Mon Aug 6 17:07:37 2018:type=update:id=vsh.5777:user=root:cmd=configure terminal ; interface mgmt0 ; no ip access-group filter_internal_snmp_i in (SUCCESS)
Mon Aug 6 17:07:37 2018:type=stop:id=vsh.5777:user=root:cmd=
Step 5 - Verify the access to the device by doing ab SSH/Telnet
Configure using SNMP
Config file as below
switch3.config:
vrf context management
ip route 0.0.0.0/0 10.128.164.1
end
SNMP command set
$ snmpset -v2c -c TEST 10.10.10.1 1.3.6.1.4.1.9.9.96.1.1.1.1.14.222 integer 6 ( to clear any previous line)
SNMPv2-SMI::enterprises.9.9.96.1.1.1.1.14.222 = INTEGER: 6
$ snmpset -v2c -c TEST 10.10.10.1 .1.3.6.1.4.1.9.9.96.1.1.1.1.2.222 integer 1 .1.3.6.1.4.1.9.9.96.1.1.1.1.3.222 integer 1 .1.3.6.1.4.1.9.9.96.1.1.1.1.4.222 integer 4 .1.3.6.1.4.1.9.9.96.1.1.1.1.5.222 a 172.18.108.26 .1.3.6.1.4.1.9.9.96.1.1.1.1.6.222 s "switch3.config" .1.3.6.1.4.1.9.9.96.1.1.1.1.14.222 integer 4
SNMPv2-SMI::enterprises.9.9.96.1.1.1.1.2.222 = INTEGER: 1
SNMPv2-SMI::enterprises.9.9.96.1.1.1.1.3.222 = INTEGER: 1
SNMPv2-SMI::enterprises.9.9.96.1.1.1.1.4.222 = INTEGER: 4
SNMPv2-SMI::enterprises.9.9.96.1.1.1.1.5.222 = IpAddress: 172.18.108.26
SNMPv2-SMI::enterprises.9.9.96.1.1.1.1.6.222 = STRING: "switch3.config"
SNMPv2-SMI::enterprises.9.9.96.1.1.1.1.14.222 = INTEGER: 4
Accounting logs
Mon Sep 3 15:15:35 2018:type=update:id=snmp_62528_10.82.250.52:user=TEST:cmd=copy tftp://172.18.108.26:69switch3.config running-config vrf management (SUCCESS)
Mon Sep 3 15:15:35 2018:type=start:id=vsh.12593:user=root:cmd=
Mon Sep 3 15:15:35 2018:type=update:id=vsh.12593:user=root:cmd=configure terminal ; vrf context management (SUCCESS)
Mon Sep 3 15:15:35 2018:type=update:id=vsh.12593:user=root:cmd=configure terminal ; vrf context management ; ip route 0.0.0.0/0 10.128.164.1 (SUCCESS)
Mon Sep 3 15:15:35 2018:type=stop:id=vsh.12593:user=root:cmd=
Reference
Nexus Security configuration guide
NXOS password recovery
Feedback