Configura SNMPv3 per il monitoraggio dello stato di salute degli switch Ethernet
Suggerisci modifiche
PDF
Configura SNMPv3 sugli switch di rete per abilitare una comunicazione sicura e autenticata con l'Ethernet switch health monitor (CSHM). SNMPv3 fornisce un polling crittografato dello stato degli switch per il monitoraggio dello stato di salute in ONTAP.
L'Ethernet Switch Health Monitor (CSHM) utilizza SNMP per monitorare lo stato e le prestazioni degli switch di rete. Per impostazione predefinita, SNMPv2c viene configurato automaticamente tramite il Reference Configuration File (RCF). SNMPv3 è più sicuro di SNMPv2 perché introduce robuste funzionalità di sicurezza come autenticazione, crittografia e integrità dei messaggi, che proteggono dall'accesso non autorizzato e garantiscono la riservatezza e l'integrità dei dati durante la trasmissione.
|
|
I seguenti comandi vengono utilizzati per configurare un nome utente SNMPv3 sugli switch Broadcom, * Cisco* e * NVIDIA*:
Configurare un nome utente SNMPv3 NETWORK-OPERATOR sugli switch Broadcom BES-53248.
|
|
A partire da ONTAP 9.20.1, puoi configurare l'autenticazione SHA-512 sugli switch Broadcom. |
-
Per nessuna autenticazione:
snmp-server user <snmpv3-user> NETWORK-OPERATOR noauth -
Per l'autenticazione MD5/SHA/SHA-512:
snmp-server user <snmpv3-user> NETWORK-OPERATOR [auth-md5|auth-sha|auth-sha512] -
Per l'autenticazione MD5/SHA/SHA-512 con crittografia AES/DES:
snmp-server user <snmpv3-user> NETWORK-OPERATOR [auth-md5|auth-sha|auth-sha512] [priv-aes128|priv-des]
Il seguente comando configura un nome utente SNMPv3 sul lato ONTAP :
security login create -user-or-group-name <snmpv3-user> -application snmp -authentication-method usm -remote-switch-ipaddress <address>Il seguente comando stabilisce il nome utente SNMPv3 con CSHM:
cluster1::*> system switch ethernet modify -device <switch-name> -snmp-version SNMPv3 -community-or-username <snmpv3-user>-
Configura l'utente SNMPv3 sullo switch per utilizzare l'autenticazione SHA e la crittografia AES-128:
(sw1)(Config)# snmp-server user SNMPv3shaAes128 NETWORK-OPERATOR auth-sha priv-aes128 (sw1)(Config)# show snmp user snmp SNMPv3shaAes128 Name Group Name Auth Priv Meth Meth Remote Engine ID Remote IP Address ----------------- ------------------ ------- ------ -------------------------------- ------------------------- SNMPv3shaAes128 NETWORK-OPERATOR SHA AES128 800XXXXXXXXXXXXXXXXXX1 -
Impostare l'utente SNMPv3 sul lato ONTAP :
cluster1::*> security login create -user-or-group-name SNMPv3shaAes128 -application snmp -authentication-method usm -remote-switch-ipaddress 192.0.2.10 Enter the authoritative entity's EngineID [remote EngineID]: Which authentication protocol do you want to choose (none, md5, sha, sha2-256, sha512) [none]: sha Enter the authentication protocol password (minimum 8 characters long): Enter the authentication protocol password again: Which privacy protocol do you want to choose (none, des, aes128) [none]: aes128 Enter privacy protocol password (minimum 8 characters long): Enter privacy protocol password again:
-
Configurare CSHM per il monitoraggio con il nuovo utente SNMPv3:
cluster1::*> system switch ethernet modify -device "sw1" -snmp-version SNMPv3 -community-or-username SNMPv3shaAes128
-
Dopo aver atteso il periodo di polling del CSHM, verifica che "Motivo del mancato monitoraggio" sia impostato su "Nessuno".
cluster1::*> system switch ethernet polling-interval show Polling Interval (in minutes): 5 cluster1::*> system switch ethernet show-all -device "sw1" -instance Device Name: sw1 IP Address: 192.0.2.10 SNMP Version: SNMPv3 Is Discovered: true DEPRECATED-Community String or SNMPv3 Username: - Community String or SNMPv3 Username: SNMPv3shaAes128 Model Number: BES-53248 Switch Network: cluster-network Software Version: 3.14.1.1 Reason For Not Monitoring: None <---- should display this if SNMP settings are valid Source Of Switch Version: CDP/ISDP Is Monitored ?: true Serial Number of the Device: QTFXXXXXXXXXC RCF Version: RCF BES-53248 v1.14a 1-CLUSTER
Configura un nome utente SNMPv3 <snmpv3-user> sugli switch Cisco Nexus.
|
|
A partire da ONTAP 9.20.1, puoi configurare l'autenticazione SHA-512 o SHA-256 sugli switch Cisco. |
-
Per nessuna autenticazione:
snmp-server user <snmpv3-user> NoAuth -
Per l'autenticazione MD5/SHA/SHA-256/SHA-512:
snmp-server user <snmpv3-user> auth [md5|sha|sha-256|sha-512] <auth-password> -
Per l'autenticazione MD5/SHA/SHA-256/SHA-512 con crittografia AES/DES:
snmp-server user <snmpv3-user> AuthEncrypt auth [md5|sha|sha-256|sha-512] <auth-password> priv [aes-128|des] <priv-password>
Il seguente comando configura un nome utente SNMPv3 sul lato ONTAP :
security login create -user-or-group-name <snmpv3-user> -application snmp -authentication-method usm -remote-switch-ipaddress <address>Il seguente comando stabilisce il nome utente SNMPv3 con CSHM:
cluster1::*> system switch ethernet modify -device <switch-name> -snmp-version SNMPv3 -community-or-username <snmpv3-user>-
Configura l'utente SNMPv3 sullo switch per utilizzare l'autenticazione SHA e la crittografia AES-128:
(sw1)(Config)# snmp-server user SNMPv3shaAes128 auth sha <auth_password> priv aes-128 <priv_password> (sw1)(Config)# show snmp use SNMPv3shaAes128 User Auth Priv(enforce) Groups Auth Mode acl_filter _ _ __ SNMPv3shaAes128 sha aes-128(no) network-operator Local (sw1)(Config)#
-
Impostare l'utente SNMPv3 sul lato ONTAP :
cluster1::*> security login create -user-or-group-name SNMPv3shaAes128 -application snmp -authentication-method usm -remote-switch-ipaddress 192.0.2.10 Enter the authoritative entity's EngineID [remote EngineID]: Which authentication protocol do you want to choose (none, md5, sha, sha2-256, sha512) [none]: sha Enter the authentication protocol password (minimum 8 characters long): Enter the authentication protocol password again: Which privacy protocol do you want to choose (none, des, aes128) [none]: aes128 Enter privacy protocol password (minimum 8 characters long): Enter privacy protocol password again:
-
Configurare CSHM per il monitoraggio con il nuovo utente SNMPv3:
cluster1::*> system switch ethernet modify -device "sw1" -snmp-version SNMPv3 -community-or-username SNMPv3shaAes128
-
Dopo aver atteso il periodo di polling del CSHM, verifica che "Motivo del mancato monitoraggio" sia impostato su "Nessuno".
cluster1::*> system switch ethernet polling-interval show Polling Interval (in minutes): 5 cluster1::*> system switch ethernet show-all -device "sw1" -instance Device Name: sw1 IP Address: 192.0.2.10 SNMP Version: SNMPv3 Is Discovered: true SNMPv2c Community String or SNMPv3 Username: SNMPv3shaAes128 Model Number: N9K-C9336C-FX2 Switch Network: cluster-network Software Version: Cisco NX-OS(tm) Nexus9000 C9336C-FX2, Software (NXOS 64-bit), Version 10.2(4), RELEASE SOFTWARE Copyright (c) 2002-2022 by Cisco Systems, Inc. Compiled 9/20/2022 12:00:00 Reason For Not Monitoring: None <---- should display this if SNMP settings are valid Source Of Switch Version: CDP/ISDP Is Monitored ?: true Serial Number of the Device: FDOXXXXXXX1 RCF Version: RCF NX9336C-FX2 v1.14 1-CLUSTER 2-STORAGE
Configura un nome utente SNMPv3 <snmpv3-user> sugli switch NVIDIA Cumulus con CL 5.4.0:
-
Per nessuna autenticazione:
nv set service snmp-server username <snmpv3-user> auth-none -
Per l'autenticazione MD5/SHA:
nv set service snmp-server username <snmpv3-user> [auth-md5|auth-sha] <auth-password> -
Per l'autenticazione MD5/SHA con crittografia AES/DES:
nv set service snmp-server username <snmpv3-user> [auth-md5|auth-sha] <auth-password> [encrypt-aes|encrypt-des] <priv-password>
Il seguente comando configura un nome utente SNMPv3 sul lato ONTAP :
security login create -user-or-group-name <snmpv3-user> -application snmp -authentication-method usm -remote-switch-ipaddress <address>Il seguente comando stabilisce il nome utente SNMPv3 con CSHM:
cluster1::*> system switch ethernet modify -device <switch-name> -snmp-version SNMPv3 -community-or-username <snmpv3-user>-
Configura l'utente SNMPv3 sullo switch per utilizzare l'autenticazione SHA e la crittografia AES-128:
cumulus@sw1:~$ net show snmp status Simple Network Management Protocol (SNMP) Daemon. --------------------------------- ---------------- Current Status active (running) Reload Status enabled Listening IP Addresses all vrf mgmt Main snmpd PID 4318 Version 1 and 2c Community String Configured Version 3 Usernames Not Configured --------------------------------- ---------------- cumulus@sw1:~$ cumulus@sw1:~$ net add snmp-server username SNMPv3shaAes128 auth-sha <auth-password> encrypt-aes <priv-password> cumulus@sw1:~$ net commit --- /etc/snmp/snmpd.conf 2020-08-02 21:09:34.686949282 +0000 +++ /run/nclu/snmp/snmpd.conf 2020-08-11 00:13:51.826126655 +0000 @@ -1,26 +1,28 @@ # Auto-generated config file: do not edit. # agentaddress udp:@mgmt:161 agentxperms 777 777 snmp snmp agentxsocket /var/agentx/master createuser _snmptrapusernameX +createuser SNMPv3shaAes128 SHA <auth-password> AES <priv-password> ifmib_max_num_ifaces 500 iquerysecname _snmptrapusernameX master agentx monitor -r 60 -o laNames -o laErrMessage "laTable" laErrorFlag != 0 pass -p 10 1.3.6.1.2.1.1.1 /usr/share/snmp/sysDescr_pass.py pass_persist 1.2.840.10006.300.43 /usr/share/snmp/ieee8023_lag_pp.py pass_persist 1.3.6.1.2.1.17 /usr/share/snmp/bridge_pp.py pass_persist 1.3.6.1.2.1.31.1.1.1.18 /usr/share/snmp/snmpifAlias_pp.py pass_persist 1.3.6.1.2.1.47 /usr/share/snmp/entity_pp.py pass_persist 1.3.6.1.2.1.99 /usr/share/snmp/entity_sensor_pp.py pass_persist 1.3.6.1.4.1.40310.1 /usr/share/snmp/resq_pp.py pass_persist 1.3.6.1.4.1.40310.2 /usr/share/snmp/cl_drop_cntrs_pp.py pass_persist 1.3.6.1.4.1.40310.3 /usr/share/snmp/cl_poe_pp.py pass_persist 1.3.6.1.4.1.40310.4 /usr/share/snmp/bgpun_pp.py pass_persist 1.3.6.1.4.1.40310.5 /usr/share/snmp/cumulus-status.py pass_persist 1.3.6.1.4.1.40310.6 /usr/share/snmp/cumulus-sensor.py pass_persist 1.3.6.1.4.1.40310.7 /usr/share/snmp/vrf_bgpun_pp.py +rocommunity cshm1! default rouser _snmptrapusernameX +rouser SNMPv3shaAes128 priv sysobjectid 1.3.6.1.4.1.40310 sysservices 72 -rocommunity cshm1! default net add/del commands since the last "net commit" User Timestamp Command --------------- -------------------------- ------------------------------------------------------------------------- SNMPv3shaAes128 2020-08-11 00:13:51.826987 net add snmp-server username SNMPv3shaAes128 auth-sha <auth-password> encrypt-aes <priv-password> cumulus@sw1:~$ cumulus@sw1:~$ net show snmp status Simple Network Management Protocol (SNMP) Daemon. --------------------------------- ---------------- Current Status active (running) Reload Status enabled Listening IP Addresses all vrf mgmt Main snmpd PID 24253 Version 1 and 2c Community String Configured Version 3 Usernames Configured <---- Configured here --------------------------------- ---------------- cumulus@sw1:~$
-
Impostare l'utente SNMPv3 sul lato ONTAP :
cluster1::*> security login create -user-or-group-name SNMPv3shaAes128 -application snmp -authentication-method usm -remote-switch-ipaddress 192.0.2.10 Enter the authoritative entity's EngineID [remote EngineID]: Which authentication protocol do you want to choose (none, md5, sha, sha2-256, sha512) [none]: sha Enter the authentication protocol password (minimum 8 characters long): Enter the authentication protocol password again: Which privacy protocol do you want to choose (none, des, aes128) [none]: aes128 Enter privacy protocol password (minimum 8 characters long): Enter privacy protocol password again:
-
Configurare CSHM per il monitoraggio con il nuovo utente SNMPv3:
cluster1::*> system switch ethernet modify -device "sw1" -snmp-version SNMPv3 -community-or-username SNMPv3shaAes128
-
Dopo aver atteso il periodo di polling del CSHM, verifica che "Motivo del mancato monitoraggio" sia impostato su "Nessuno".
cluster1::*> system switch ethernet polling-interval show Polling Interval (in minutes): 5 cluster1::*> system switch ethernet show-all -device "sw1" -instance Device Name: sw1 IP Address: 192.0.2.10 SNMP Version: SNMPv3 Is Discovered: true DEPRECATED-Community String or SNMPv3 Username: - Community String or SNMPv3 Username: SNMPv3shaAes128 Model Number: MSN2100-CB2FC Switch Network: cluster-network Software Version: Cumulus Linux version 5.4.0 running on Mellanox Technologies Ltd. MSN2100 Reason For Not Monitoring: None <---- should display this if SNMP settings are valid Source Of Switch Version: LLDP Is Monitored ?: true Serial Number of the Device: MT2110X06399 RCF Version: RCF MSN2100 v1.14 1-CLUSTER
Configura un nome utente SNMPv3 <snmpv3-user> sugli switch NVIDIA Cumulus con CLI 5.11.0 o versioni successive:
-
Per nessuna autenticazione:
nv set system snmp-server username <snmpv3-user> auth-none -
Per l'autenticazione MD5/SHA:
nv set system snmp-server username <snmpv3-user> [auth-md5|auth-sha] <auth-password> -
Per l'autenticazione MD5/SHA con crittografia AES/DES:
nv set system snmp-server username <snmpv3-user> [auth-md5|auth-sha] <auth-password> [encrypt-aes|encrypt-des] <priv-password>
Il seguente comando configura un nome utente SNMPv3 sul lato ONTAP :
security login create -user-or-group-name <snmpv3-user> -application snmp -authentication-method usm -remote-switch-ipaddress <address>Il seguente comando stabilisce il nome utente SNMPv3 con CSHM:
cluster1::*> system switch ethernet modify -device <switch-name> -snmp-version SNMPv3 -community-or-username <snmpv3-user>-
Configura l'utente SNMPv3 sullo switch per utilizzare l'autenticazione SHA e la crittografia AES-128:
cumulus@sw1:~$ nv set system snmp-server username SNMPv3shaAes128 auth-sha <auth-password> encrypt-aes <priv-password> created [rev_id: 14] cumulus@sw1:~$ nv config apply applied_and_saved [rev_id: 14] cumulus@sw1:~$ nv show system snmp-server username SNMPv3shaAes128 applied ---------- --------------------------------------- [auth-sha] $nvsec$836XXXXXXXXXXXXXXXXXXXXXXXXXXXXX -
Impostare l'utente SNMPv3 sul lato ONTAP :
cluster1::*> security login create -user-or-group-name SNMPv3shaAes128 -application snmp -authentication-method usm -remote-switch-ipaddress 192.0.2.10 Enter the authoritative entity's EngineID [remote EngineID]: Which authentication protocol do you want to choose (none, md5, sha, sha2-256, sha512) [none]: sha Enter the authentication protocol password (minimum 8 characters long): Enter the authentication protocol password again: Which privacy protocol do you want to choose (none, des, aes128) [none]: aes128 Enter privacy protocol password (minimum 8 characters long): Enter privacy protocol password again:
-
Configurare CSHM per il monitoraggio con il nuovo utente SNMPv3:
cluster1::*> system switch ethernet modify -device "sw1" -snmp-version SNMPv3 -community-or-username SNMPv3shaAes128
-
Dopo aver atteso il periodo di polling del CSHM, verifica che "Motivo del mancato monitoraggio" sia impostato su "Nessuno".
cluster1::*> system switch ethernet polling-interval show Polling Interval (in minutes): 5 cluster1::*> system switch ethernet show-all -device "sw1" -instance Device Name: sw1 IP Address: 192.0.2.10 SNMP Version: SNMPv3 Is Discovered: true DEPRECATED-Community String or SNMPv3 Username: - Community String or SNMPv3 Username: SNMPv3shaAes128 Model Number: MSN2100-CB2FC Switch Network: cluster-network Software Version: Cumulus Linux version 5.11.0 running on Mellanox Technologies Ltd. MSN2100 Reason For Not Monitoring: None <---- should display this if SNMP settings are valid Source Of Switch Version: LLDP Is Monitored ?: true Serial Number of the Device: MT2110X06399 RCF Version: RCF MSN2100 v1.14 1-CLUSTER