-
Cisco ASA 5500 Series Configuration Guide using the CLI, 8.3
-
About This Guide
-
Glossary
- Getting Started and General Information
- Setting Up the Adaptive Security Appliance
- Configuring Access Lists
- Configuring IP Routing
- Configuring NAT
- Configuring Service Policies Using the Modular Policy Framework
- Configuring Access Control
- Configuring Application Inspection
- Configuring Unified Communications
- Configuring Connection Settings and QoS
- Configuring Advanced Network Protection
- Configuring Applications on SSMs and SSCs
- Configuring High Availability
-
Configuring VPN
-
Configuring IPSec and ISAKMP
-
Configuring L2TP over IPSec
-
Setting General VPN Parameters
-
Configuring Tunnel Groups, Group Policies, and Users
-
Configuring IP Addresses for VPN
-
Configuring Remote Access VPNs
-
Configuring Network Admission Control
-
Configuring Easy VPN on the ASA 5505
-
Configuring the PPPoE Client
-
Configuring LAN-to-LAN VPNs
-
Configuring Clientless SSL VPN
-
Configuring AnyConnect VPN Client Connections
-
- Configuring Logging and SNMP
- System Administration
- Reference
-
Feedback
Table Of Contents
Information About SNMP Terminology
Information About MIBs and Traps
Implementation Differences Between Adaptive Security Appliances and the Cisco IOS
Licensing Requirements for SNMP
Compiling Cisco Syslog MIB Files
Configuration Examples for SNMP
Configuration Example for SNMP Versions 1 and 2c
Configuration Example for SNMP Version 3
Application Services and Third-Party Tools
Configuring SNMP
This chapter describes how to configure SNMP to monitor the adaptive security appliance and includes the following sections:
•
Licensing Requirements for SNMP
•
Information about SNMP
SNMP is an application-layer protocol that facilitates the exchange of management information between network devices. It is part of the TCP/IP protocol suite. This section describes SNMP monitoring, and includes the following topics:
•
•
The adaptive security appliance provides support for network monitoring using SNMP Versions 1, 2c, and 3, and supports the use of all three versions simultaneously. The SNMP interface lets you monitor the adaptive security appliance through network management systems (NMSs), such as HP OpenView. The adaptive security appliance supports SNMP read-only access through issuance of a GET request. SNMP write access is not allowed, so you cannot make changes with SNMP. In addition, the SNMP SET request is not supported.
You can configure the adaptive security appliance to send traps, which are unsolicited comments from the managed device to the management station for certain events (event notifications) to an NMS, or you can use the NMS to browse the MIBs on the adaptive security appliance. MIBs are a collection of definitions, and the adaptive security appliance maintains a database of values for each definition. Browsing a MIB means issuing a series of GET-NEXT or GET-BULK requests of the MIB tree from the NMS to determine values.
The adaptive security appliance has an SNMP agent that notifies designated management stations if events occur that are pre-defined to require a notification, for example, when a link in the network goes up or down. The notification it sends includes an SNMP OID, which identifies itself to the management stations. The adaptive security appliance SNMP agent also replies when a management station asks for information.
Information About SNMP Terminology
Table 74-1 lists the terms that are commonly used when working with SNMP:
Information About MIBs and Traps
MIBs are either standard or enterprise-specific. Standard MIBs are created by the IETF and documented in various RFCs. A trap reports significant events occurring on a network device, most often errors or failures. SNMP traps are defined in either standard or enterprise-specific MIBs. Standard traps are created by the IETF and documented in various RFCs. Standard traps are compiled into the adaptive security appliance software.
If needed, you can also download RFCs, standard MIBs, and standard traps from the IETF website:
Download Cisco MIBs and OIDs from the following location:
http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml
Download Cisco OIDs from the following location:
ftp://ftp.cisco.com/pub/mibs/oid/oid.tar.gz
Note
SNMP Version 3
This section describes SNMP Version 3 and includes the following topics:
•
SNMP Version 3 Overview
SNMP Version 3 provides security enhancements that are not available in SNMP Version 1 or SNMP Version 2c. SNMP Versions 1 and 2c transmit data between the SNMP server and SNMP agent in clear text. SNMP Version 3 adds authentication and privacy options to secure protocol operations. In addition, this version controls access to the SNMP agent and MIB objects through the User-based Security Model (USM) and View-based Access Control Model (VACM). The ASA 5500 series adaptive security appliances also support the creation of SNMP groups and users, as well as hosts, which is required to enable transport authentication and encryption for secure SNMP communications.
Security Models
For configuration purposes, the authentication and privacy options are grouped together into security models. Security models apply to users and groups, which are divided into the following three types:
•
•
•
SNMP Groups
An SNMP group is an access control policy to which users can be added. Each SNMP group is configured with a security model, and is associated with an SNMP view. A user within an SNMP group must match the security model of the SNMP group. These parameters specify what type of authentication and privacy a user within an SNMP group uses. Each SNMP group name and security model pair must be unique.
SNMP Users
SNMP users have a specified username, a group to which the user belongs, authentication password, encryption password, and authentication and encryption algorithms to use. The authentication algorithm options are MD5 and SHA. The encryption algorithm options are DES, 3DES, and AES (which is available in 128, 192, and 256 versions). When you create a user, you must associate it with an SNMP group. The user then inherits the security model of the group.
SNMP Hosts
An SNMP host is an IP address to which SNMP notifications and traps are sent. To configure SNMP Version 3 hosts, along with the target IP address, you must configure a username, because traps are only sent to a configured user. SNMP target IP addresses and target parameter names must be unique on the adaptive security appliance. Each SNMP host can have only one username associated with it. To receive SNMP traps, after you have added the snmp-server host command, make sure that you configure the user credentials on the NMS to match those configured on the adaptive security appliance.
Implementation Differences Between Adaptive Security Appliances and the Cisco IOS
The SNMP Version 3 implementation in adaptive security appliances differs from the SNMP Version 3 implementation in the Cisco IOS in the following ways:
•
•
•
•
•
•
Licensing Requirements for SNMP
The following table shows the licensing requirements for this feature:
Prerequisites for SNMP
SNMP has the following prerequisite:
You must have Cisco Works for Windows or another SNMP MIB-II compliant browser to receive SNMP traps or browse a MIB.
Guidelines and Limitations
Context Mode Guidelines
Supported in single and multiple context modes.
Firewall Mode Guidelines
Supported in routed and transparent firewall modes.
Failover Guidelines
•
•
IPv6 Guidelines
Does not support IPv6.
Additional Guidelines
•
•
•
•
•
•
•
•
–
–
–
•
•
Configuring SNMP
This section describes how to configure SNMP and includes the following topics:
•
Enabling SNMP
The SNMP agent that runs on the adaptive security appliance performs two functions:
•
•
To enable the SNMP agent and identify an NMS that can connect to the SNMP server, enter the following command:
hostname(config)# snmp-server enable
Ensures that the SNMP server on the adaptive security appliance is enabled. By default, the SNMP server is enabled.
What to Do Next
See the "Configuring SNMP Traps" section.
Configuring SNMP Traps
To designate which traps the SNMP agent generates and how they are collected and sent to NMSs, enter the following command:
Detailed Steps
What to Do Next
See the "Compiling Cisco Syslog MIB Files" section.
Compiling Cisco Syslog MIB Files
To receive security and failover SNMP traps from the adaptive security appliance, compile the Cisco SMI MIB and the Cisco Syslog MIB into the SNMP management application. If you do not compile the Cisco Syslog MIB into your application, you only receive traps for linkup or linkdown, coldstart, and authentication failure.
To compile Cisco Syslog MIB files into your browser using Cisco Works for Windows, perform the following steps:
Step 1
http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml
Step 2
The Adaptive Security Appliance MIB Support List appears.
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Note
Step 9
Step 10
Step 11
Step 12
Step 13
Step 14
Step 15
Step 16
Step 17
Step 18
Step 19
Step 20
What to Do Next
Choose one of the following:
•
•
Using SNMP Version 1 or 2c
To configure parameters for SNMP Version 1 or 2c, perform the following steps:
Detailed Steps
Step 1
hostname(config)# snmp-server host mgmt 10.7.14.90 version 2
hostname(config)# snmp-server host corp 172.18.154.159 community public
Specifies the recipient of an SNMP notification. Indicates the interface from which traps are sent. Identifies the name and IP address of the NMS or SNMP manager that can connect to the adaptive security appliance. The trap keyword limits the NMS to receiving traps only. The poll keyword limits the NMS to sending requests (polling) only. By default, SNMP traps are enabled. By default, the UDP port is 162. The community string is a shared secret key between the adaptive security appliance and the NMS. The key is a case-sensitive value up to 32 characters in length. Spaces are not permitted. The default community-string is "public." The adaptive security appliance uses this key to determine whether the incoming SNMP request is valid. For example, you could designate a site with a community string and then configure the adaptive security appliance and the management station with the same string. The adaptive security appliance uses the specified string and does not respond to requests with an invalid community string. For more information about SNMP hosts, see the "SNMP Hosts" section.
Note
Step 2
snmp-server community community-stringExample:hostname(config)# snmp-server community onceuponatime
Sets the community string, which is for use only with SNMP Version 1 or 2c.
Step 3
hostname(config)# snmp-server location building 42
hostname(config)# snmp-server contact EmployeeA
Sets the SNMP server location or contact information.
What to Do Next
See the "Monitoring SNMP" section.
Using SNMP Version 3
To configure parameters for SNMP Version 3, perform the following steps:
Detailed Steps
Step 1
hostname(config)# snmp-server group testgroup1 v3 auth
Specifies a new SNMP group, which is for use only with SNMP Version 3. When a community string is configured, two additional groups with the name that matches the community string are autogenerated: one for the Version 1 security model and one for the Version 2 security model. For more information about security models, see the "Security Models" section. The auth keyword enables packet authentication. The noauth keyword indicates no packet authentication or encryption is being used. The priv keyword enables packet encryption and authentication. No default values exist for the auth or priv keywords.
Step 2
snmp-server user username group-name {v3 [encrypted]] [auth {md5 | sha]} auth-password [priv [des | 3des | aes] [128 | 192 | 256] priv-passwordExample:hostname(config)# snmp-server user testuser1 testgroup1 v3 auth md5 testpassword aes 128 mypassword
hostname(config)# snmp-server user testuser1 public v3 encrypted auth md5 00:11:22:33:44:55:66:77:88:99:AA: BB:CC:DD:EE:FF
Configures a new user for an SNMP group, which is for use only with SNMP Version 3. The username argument is the name of the user on the host that belongs to the SNMP agent. The group-name argument is the name of the group to which the user belongs. The v3 keyword specifies that the SNMP Version 3 security model should be used, and enables the use of the encrypted, priv, and the auth keywords. The encrypted keyword specifies the password in encrypted format. Encrypted passwords must be in hexadecimal format. The auth keyword specifies which authentication level (md5 or sha) should be used. The priv keyword specifies the encryption level. No default values for the auth or priv keywords nor default passwords exist. For the encryption algorithm, you can specify either des, 3des, or aes. You can also specify which version of the AES encryption algorithm to use: 128, 192, or 256. The auth-password specifies the authentication user password. The priv-password specifies the encryption user password.
Note
Step 3
hostname(config)# snmp-server host mgmt 10.7.14.90 version 3 testuser1
hostname(config)# snmp-server host mgmt 10.7.26.5 version 3 testuser2
Specifies the recipient of an SNMP notification. Indicates the interface from which traps are sent. Identifies the name and IP address of the NMS or SNMP manager that can connect to the adaptive security appliance. The trap keyword limits the NMS to receiving traps only. The poll keyword limits the NMS to sending requests (polling) only. By default, SNMP traps are enabled. By default, the UDP port is 162. The community string is a shared secret key between the adaptive security appliance and the NMS. The key is a case-sensitive value up to 32 characters in length. Spaces are not permitted. The default community-string is "public." The adaptive security appliance uses this key to determine whether the incoming SNMP request is valid. For example, you could designate a site with a community string and then configure the adaptive security appliance and the NMS with the same string. The adaptive security appliance uses the specified string and does not respond to requests with an invalid community string. For more information about SNMP hosts, see the "SNMP Hosts" section.
Note
Step 4
hostname(config)# snmp-server location building 42
hostname(config)# snmp-server contact EmployeeA
Sets the SNMP server location or contact information.
What to Do Next
See the "Monitoring SNMP" section.
Troubleshooting Tips
To ensure that the SNMP process that receives incoming packets from the NMS is running, enter the following command:
hostname(config)# show process | grep snmpTo capture syslog messages from SNMP and have them appear on the adaptive security appliance console, enter the following commands:
hostname(config)# logging list snmp message 212001-212015hostname(config)# logging console snmpTo make sure that the SNMP process is sending and receiving packets, enter the following commands:
hostname(config)# clear snmp-server statisticshostname(config)# show snmp-server statisticsThe output is based on the SNMP group of the SNMPv2-MIB.
To make sure that SNMP packets are going through the adaptive security appliance and to the SNMP process, enter the following commands:
hostname(config)# clear asp drophostname(config)# show asp dropIf the NMS cannot request objects successfully or is not handing incoming traps from the adaptive security appliance correctly, use a packet capture to isolate the problem, by entering the following commands:
hostname (config)# access-list snmp permit udp any eq snmptrap anyhostname (config)# access-list snmp permit udp any any eq snmphostname (config)# capture snmp type raw-data access-list snmp interface mgmthostname (config)# copy /pcap capture:snmp tftp://192.0.2.5/exampledir/snmp.pcapIf the adaptive security appliance is not performing as expected, obtain information about network topology and traffic by doing the following:
•
–
–
–
–
•
–
–
–
–
If a fatal error occurs, to help in reproducing the error, send a traceback file and the output of the show tech-support command to Cisco TAC.
If SNMP traffic is not being allowed through the adaptive security appliance interfaces, you might also need to permit ICMP traffic from the remote SNMP server using the icmp permit command.
For the ASA 5580, differences may appear in the physical interface statistics output and the logical interface statistics output between the show interface command and the show traffic command.
Interface Types and Examples
The interface types that produce SNMP traffic statistics include the following:
•
•
Note
•
The examples in Table 74-2 show the differences in SNMP traffic statistics.
Monitoring SNMP
NMSs are the PCs or workstations that you set up to monitor SNMP events and manage devices, such as the adaptive security appliance.You can monitor the health of a device from an NMS by polling required information from the SNMP agent that has been set up on the device. Predefined events from the SNMP agent to the NMS generate syslog messages. This section includes the following topics:
SNMP Syslog Messaging
SNMP generates detailed syslog messages numbered 212nnn. Syslog messages indicate the status of SNMP requests, SNMP traps, SNMP channels, and SNMP responses from the adaptive security appliance to a specified host on a specified interface.
For detailed information about syslog messages, see Cisco ASA 5500 Series System Log Messages.
Note
SNMP Monitoring Commands
To monitor SNMP, enter one of the following commands:
Examples
The following examples show how to display SNMP server statistics and the SNMP server running configuration:
hostname(config)# show snmp-server statistics0 SNMP packets input0 Bad SNMP version errors0 Unknown community name0 Illegal operation for community name supplied0 Encoding errors0 Number of requested variables0 Number of altered variables0 Get-request PDUs0 Get-next PDUs0 Get-bulk PDUs0 Set-request PDUs (Not supported)0 SNMP packets output0 Too big errors (Maximum packet size 512)0 No such name errors0 Bad values errors0 General errors0 Response PDUs0 Trap PDUshostname(config)# show running-config snmp-serverno snmp-server locationno snmp-server contactsnmp-server enable traps snmp authentication linkup linkdown coldstartConfiguration Examples for SNMP
This section includes the following topics:
•
•
Configuration Example for SNMP Versions 1 and 2c
The following example shows how the adaptive security appliance can receive SNMP requests from host 192.0.2.5 on the inside interface but does not send any SNMP syslog requests to any host:
hostname(config)# snmp-server host 192.0.2.5hostname(config)# snmp-server location building 42hostname(config)# snmp-server contact EmployeeAhostname(config)# snmp-server community ohwhatakeyistheeConfiguration Example for SNMP Version 3
The following example show how the adaptive security appliance can receive SNMP requests using the SNMP Version 3 security model, which requires that the configuration follow this specific order: group, followed by user, followed by host:
hostname(config)# snmp-server group v3 vpn-group privhostname(config)# snmp-server user admin vpn group v3 auth sha letmein priv 3des cisco123hostname(config)# snmp-server host mgmt 10.0.0.1 version 3 priv adminWhere to Go Next
To configure the syslog server, see Chapter 72 "Configuring Logging."
Additional References
For additional information related to implementing SNMP, see the following sections:
•
•
RFCs for SNMP Version 3
MIBs
For a list of supported MIBs and traps for the adaptive security appliance by release, see the following URL:
http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml
To obtain a list of the supported SNMP MIBs for a specific adaptive security appliance, enter the following command:
hostname(config)# show snmp-server oidlist
Note
The following is sample output from the show snmp-server oidlist command:
[0] 1.3.6.1.2.1.1.1. sysDescr[1] 1.3.6.1.2.1.1.2. sysObjectID[2] 1.3.6.1.2.1.1.3. sysUpTime[3] 1.3.6.1.2.1.1.4. sysContact[4] 1.3.6.1.2.1.1.5. sysName[5] 1.3.6.1.2.1.1.6. sysLocation[6] 1.3.6.1.2.1.1.7. sysServices[7] 1.3.6.1.2.1.2.1. ifNumber[8] 1.3.6.1.2.1.2.2.1.1. ifIndex[9] 1.3.6.1.2.1.2.2.1.2. ifDescr[10] 1.3.6.1.2.1.2.2.1.3. ifType[11] 1.3.6.1.2.1.2.2.1.4. ifMtu[12] 1.3.6.1.2.1.2.2.1.5. ifSpeed[13] 1.3.6.1.2.1.2.2.1.6. ifPhysAddress[14] 1.3.6.1.2.1.2.2.1.7. ifAdminStatus[15] 1.3.6.1.2.1.2.2.1.8. ifOperStatus[16] 1.3.6.1.2.1.2.2.1.9. ifLastChange[17] 1.3.6.1.2.1.2.2.1.10. ifInOctets[18] 1.3.6.1.2.1.2.2.1.11. ifInUcastPkts[19] 1.3.6.1.2.1.2.2.1.12. ifInNUcastPkts[20] 1.3.6.1.2.1.2.2.1.13. ifInDiscards[21] 1.3.6.1.2.1.2.2.1.14. ifInErrors[22] 1.3.6.1.2.1.2.2.1.16. ifOutOctets[23] 1.3.6.1.2.1.2.2.1.17. ifOutUcastPkts[24] 1.3.6.1.2.1.2.2.1.18. ifOutNUcastPkts[25] 1.3.6.1.2.1.2.2.1.19. ifOutDiscards[26] 1.3.6.1.2.1.2.2.1.20. ifOutErrors[27] 1.3.6.1.2.1.2.2.1.21. ifOutQLen[28] 1.3.6.1.2.1.2.2.1.22. ifSpecific[29] 1.3.6.1.2.1.4.1. ipForwarding[30] 1.3.6.1.2.1.4.20.1.1. ipAdEntAddr[31] 1.3.6.1.2.1.4.20.1.2. ipAdEntIfIndex[32] 1.3.6.1.2.1.4.20.1.3. ipAdEntNetMask[33] 1.3.6.1.2.1.4.20.1.4. ipAdEntBcastAddr[34] 1.3.6.1.2.1.4.20.1.5. ipAdEntReasmMaxSize[35] 1.3.6.1.2.1.11.1. snmpInPkts[36] 1.3.6.1.2.1.11.2. snmpOutPkts[37] 1.3.6.1.2.1.11.3. snmpInBadVersions[38] 1.3.6.1.2.1.11.4. snmpInBadCommunityNames[39] 1.3.6.1.2.1.11.5. snmpInBadCommunityUses[40] 1.3.6.1.2.1.11.6. snmpInASNParseErrs[41] 1.3.6.1.2.1.11.8. snmpInTooBigs[42] 1.3.6.1.2.1.11.9. snmpInNoSuchNames[43] 1.3.6.1.2.1.11.10. snmpInBadValues[44] 1.3.6.1.2.1.11.11. snmpInReadOnlys[45] 1.3.6.1.2.1.11.12. snmpInGenErrs[46] 1.3.6.1.2.1.11.13. snmpInTotalReqVars[47] 1.3.6.1.2.1.11.14. snmpInTotalSetVars[48] 1.3.6.1.2.1.11.15. snmpInGetRequests[49] 1.3.6.1.2.1.11.16. snmpInGetNexts[50] 1.3.6.1.2.1.11.17. snmpInSetRequests[51] 1.3.6.1.2.1.11.18. snmpInGetResponses[52] 1.3.6.1.2.1.11.19. snmpInTraps[53] 1.3.6.1.2.1.11.20. snmpOutTooBigs[54] 1.3.6.1.2.1.11.21. snmpOutNoSuchNames[55] 1.3.6.1.2.1.11.22. snmpOutBadValues[56] 1.3.6.1.2.1.11.24. snmpOutGenErrs[57] 1.3.6.1.2.1.11.25. snmpOutGetRequests[58] 1.3.6.1.2.1.11.26. snmpOutGetNexts[59] 1.3.6.1.2.1.11.27. snmpOutSetRequests[60] 1.3.6.1.2.1.11.28. snmpOutGetResponses[61] 1.3.6.1.2.1.11.29. snmpOutTraps[62] 1.3.6.1.2.1.11.30. snmpEnableAuthenTraps[63] 1.3.6.1.2.1.11.31. snmpSilentDrops[64] 1.3.6.1.2.1.11.32. snmpProxyDrops[65] 1.3.6.1.2.1.31.1.1.1.1. ifName[66] 1.3.6.1.2.1.31.1.1.1.2. ifInMulticastPkts[67] 1.3.6.1.2.1.31.1.1.1.3. ifInBroadcastPkts[68] 1.3.6.1.2.1.31.1.1.1.4. ifOutMulticastPkts[69] 1.3.6.1.2.1.31.1.1.1.5. ifOutBroadcastPkts[70] 1.3.6.1.2.1.31.1.1.1.6. ifHCInOctets--More--Application Services and Third-Party Tools
For information about SNMP support, see the following URL:
http://www.cisco.com/en/US/tech/tk648/tk362/tk605/tsd_technology_support_sub-protocol_home.html
For information about using third-party tools to walk SNMP Version 3 MIBs, see the following URL:
http://www.cisco.com/en/US/docs/security/asa/asa83/snmp/snmpv3_tools.html
Feature History for SNMP
Table 74-3 lists each feature change and the platform release in which it was implemented.
