PDF

SNMP

Updated: April 15, 2026

Want to summarize with AI?

Log in

Describes the Simple Network Management Protocol (SNMP) support in ACI.

SNMP is a network management protocol that

  • provides extensive SNMPv2 and v3 support, including Management Information Bases (MIBs) and notifications (traps)

  • allows third-party applications that support the different MIBs to manage and monitor the Cisco ACI fabric, and

  • enables selective configuration of SNMP service for each device.

SNMP security and encryption features

SNMPv3 provides extended security. Each SNMPv3 device can be selectively enabled or disabled for SNMP service. In addition, each device can be configured with a method of handling SNMP v2 requests.

Beginning in the 4.2(6) release, SNMPv3 supports the Secure Hash Algorithm-2 (SHA-2) authentication type.

Beginning with Cisco APIC release 6.2(2), the ACI fabric supports the Advanced Encryption Standard (AES) 256-bit encryption algorithm for SNMPv3 privacy.

For more information about using SNMP, see the Cisco ACI MIB Quick Reference.

SNMP Access Support in Cisco ACI

SNMP access support in Cisco ACI defines which SNMP operations and features are available for leaf and spine switches and the APIC controller.

  • SNMP read queries (Get, Next, Bulk, Walk) are supported by leaf and spine switches and by the APIC controller.

  • SNMP write commands (Set) are not supported by leaf and spine switches or by the APIC controller.

  • SNMP traps (v1, v2c, and v3) are supported by leaf and spine switches and by the APIC controller.

  • SNMPv3 is supported by leaf and spine switches and by the APIC controller.

  • SNMP using an APIC IPv6 address is not supported.

SNMP Access Reference Information

For the complete list of MIBs supported in Cisco ACI, see https://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/1-x/mib/list/mib-support.html .

SNMP trap support includes a maximum of 10 trap receivers in Cisco ACI.

  • SNMP trap receivers are limited to 10 in Cisco ACI.

SNMP support changes by APIC release are summarized in the following table.

Table 1. SNMP Support Changes by APIC Release

Release

Description

6.1(2)

SNMP daemon will not start during the APIC bring up. It will start when the user attaches the SNMP policy to the pod profile policy and configures adminSt as "Enabled". Similarly, it will stop when the user either configures adminSt as "Disabled" or removes the SNMP policy from the pod-profile policy. This behaviour is also applicable to the SNMP trap daemon. Hence, the SNMP trap aggregation feature relies on the SNMP policy admin state. For SNMP trap aggregation to work, add all the APICs as trap forwarding destinations.

1.2(2)

IPv6 support is added for SNMP trap destinations.

1.2(1)

SNMP support for the APIC controller is added. Previous releases support SNMP only for leaf and spine switches.

Configure SNMP trap aggregation

The SNMP Trap Aggregation feature allows SNMP traps from the fabric nodes to be aggregated by Cisco Application Policy Infrastructure Controllers (APICs) and allows the forwarding of SNMP traps received from the fabric nodes to the external destination by the APICs.

Use this feature if you expect traps to come from APIC instead of from individual fabric nodes. With this feature enabled, APIC acts as an SNMP proxy.

We highly recommend that you configure all APICs in the cluster as SNMP trap aggregators to handle possible failures. You can configure multiple trap destinations in the SNMP policy.

Before you begin

To configure trap aggregation and forwarding, follow these steps:

Procedure

  1. Configure each APIC controller to receive traps from the switches.

    Follow the procedure in Configure an SNMP trap destination using the GUI using these settings:

    • In the Host Name/IP field, specify the IPv4 or IPv6 address of the APIC.

    • From the Management EPG list, select the out-of-band or inband management EPG.

    Repeat this procedure to configure each APIC in the cluster as a trap destination.

  2. Configure the APIC to forward aggregated traps to an external server.

    Follow the procedure in Configure the SNMP policy using the GUI using these settings:

    • In the Trap Forward Servers table, add the IP Address of the external server.

With trap aggregation and forwarding, the source IP address of the forwarded trap is the address of the aggregator (in this case, the APIC) and not the actual source node. To determine the actual source, you must search in the OID. In this example, the address 10.202.0.1 is the APIC IP address, and the address 10.202.0.201 is the IP address of the original source leaf switch.


08:53:10.372378 IP 
(tos 0x0, ttl 60, id 59067, offset 0, flags [DF], proto UDP (17), length 300)
    10.202.0.1.45419 > 192.168.254.200.162: [udp sum ok]  
    { SNMPv2c C="SNMP-ACI" { V2Trap(252) R=609795065  
    .1.3.6.1.2.1.1.3.0=25847714 .1.3.6.1.6.3.1.1.4.1.0=.1.3.6.1.4.1.9.9.276.0.1 
    .1.3.6.1.2.1.2.2.1.1.436207616=436207616 .1.3.6.1.2.1.2.2.1.7.436207616=2 
    .1.3.6.1.2.1.2.2.1.8.436207616=2 .1.3.6.1.2.1.31.1.1.1.1.436207616="eth1/1" 
    .1.3.6.1.2.1.2.2.1.3.436207616=6 .1.3.6.1.2.1.2.2.1.2.436207616="eth1/1" 
    .1.3.6.1.2.1.31.1.1.1.18.436207616="" 
    .1.3.6.1.4.1.9.10.22.1.4.1.1.6="10.202.0.201" } }

The SNMP Trap Aggregation feature was introduced in the Cisco APIC release 3.1(1) with support for SNMPV2 trap aggregation and forwarding. Beginning in the Cisco APIC releases 4.2(6) and 5.1(1), SNMPv3 trap aggregation and forwarding is supported.

Note
If an APIC is decommissioned, the user is expected to clean reboot the decommissioned APIC. Since SNMP Trap Aggregation functionality is active on decommissioned APICs, the user could receive duplicate traps on the trap destination if the decommissioned APIC is not clean rebooted.

SNMP AES-256 Privacy Encryption

Starting with Cisco APIC release 6.2(2), the ACI fabric includes support for the Advanced Encryption Standard (AES) 256-bit encryption algorithm for SNMPv3 privacy. AES-256, a symmetric encryption algorithm, utilizes a 256-bit key to ensure strong security for SNMP traffic. You can now choose AES-256 as a privacy type when configuring SNMP through the APIC GUI or REST API.

SNMPv3 provides secure access to devices by authenticating and encrypting packets over the network. While previous versions supported AES-128, the addition of AES-256 provides enhanced security compliance and meets audit requirements for high-security environments.

The Cisco APIC controller allows you to configure an encryption algorithm for SNMP users. The SNMP agent utilizes the configured hashing techniques (SHA1, SHA-224, SHA-256, SHA-384, SHA-512) to convert and store the hashed value of the SNMP user's plain-text password as the encryption/privacy key.

Mixed mode behavior

In a fabric running mixed software versions, AES-256 is only supported on nodes running version 6.2(2) or later. If you configure AES-256 privacy in an SNMP policy on a node that is running a version earlier than 6.2(2), APIC raises a fault.

AES-256 privacy supports all standard authentication hashing techniques: SHA1, SHA-224, SHA-256, SHA-384, and SHA-512.

Configuring SNMPv3 access

To configure the SNMPv3 access, refer to this proecedure.

Verification

To verify that a user is correctly configured for AES-256 privacy, use the command on the switch CLI: 
show snmp user