Configurar SNMPv3 para monitorar a integridade dos switches IP do MetroCluster
Sugerir alterações
PDFs
Nas configurações IP do MetroCluster, você pode configurar o SNMPv3 para monitorar a integridade dos switches IP.
Este procedimento mostra as etapas genéricas para configurar o SNMPv3 em um switch. Algumas das versões de firmware de switch listadas podem não ser suportadas em uma configuração de IP do MetroCluster.
Você deve seguir as etapas para uma versão de firmware do switch compatível com uma configuração de IP do MetroCluster. Consulte a "Hardware Universe" para verificar as versões de firmware suportadas.
|
|
Os comandos a seguir são usados para configurar um nome de usuário SNMPv3 nos switches Broadcom, Cisco e NVIDIA:
Configure um OPERADOR DE REDE de nome de usuário SNMPv3 em switches Broadcom BES-53248.
|
|
A partir do ONTAP 9.20.1, você pode configurar a autenticação SHA-512 nos switches Broadcom. |
-
Para sem autenticação:
snmp-server user <snmpv3-user> NETWORK-OPERATOR noauth -
Para autenticação MD5/SHA/SHA-512:
snmp-server user <snmpv3-user> NETWORK-OPERATOR [auth-md5|auth-sha|auth-sha512] -
Para autenticação MD5/SHA/SHA-512 com criptografia AES/DES:
snmp-server user <snmpv3-user> NETWORK-OPERATOR [auth-md5|auth-sha|auth-sha512] [priv-aes128|priv-des]
O seguinte comando configura um nome de usuário SNMPv3 no lado ONTAP:
security login create -user-or-group-name <snmpv3-user> -application snmp -authentication-method usm -remote-switch-ipaddress <address>O seguinte comando estabelece o nome de usuário SNMPv3 com CSHM:
cluster1::*> system switch ethernet modify -device <switch-name> -snmp-version SNMPv3 -community-or-username <snmpv3-user>-
Configure o usuário SNMPv3 no switch para usar autenticação SHA e criptografia AES-128:
(sw1)(Config)# snmp-server user SNMPv3shaAes128 NETWORK-OPERATOR auth-sha priv-aes128 (sw1)(Config)# show snmp user snmp SNMPv3shaAes128 Name Group Name Auth Priv Meth Meth Remote Engine ID Remote IP Address ----------------- ------------------ ------- ------ -------------------------------- ------------------------- SNMPv3shaAes128 NETWORK-OPERATOR SHA AES128 800XXXXXXXXXXXXXXXXXX1 -
Configure o usuário SNMPv3 no lado ONTAP:
cluster1::*> security login create -user-or-group-name SNMPv3shaAes128 -application snmp -authentication-method usm -remote-switch-ipaddress 192.0.2.10 Enter the authoritative entity's EngineID [remote EngineID]: Which authentication protocol do you want to choose (none, md5, sha, sha2-256, sha512) [none]: sha Enter the authentication protocol password (minimum 8 characters long): Enter the authentication protocol password again: Which privacy protocol do you want to choose (none, des, aes128) [none]: aes128 Enter privacy protocol password (minimum 8 characters long): Enter privacy protocol password again:
-
Configure o CSHM para monitorar com o novo usuário SNMPv3:
cluster1::*> system switch ethernet modify -device "sw1" -snmp-version SNMPv3 -community-or-username SNMPv3shaAes128
-
Após aguardar o período de coleta de dados do CSHM, verifique se a opção "Motivo para não monitorar" está definida como "Nenhum".
cluster1::*> system switch ethernet polling-interval show Polling Interval (in minutes): 5 cluster1::*> system switch ethernet show-all -device "sw1" -instance Device Name: sw1 IP Address: 192.0.2.10 SNMP Version: SNMPv3 Is Discovered: true DEPRECATED-Community String or SNMPv3 Username: - Community String or SNMPv3 Username: SNMPv3shaAes128 Model Number: BES-53248 Switch Network: cluster-network Software Version: 3.14.1.1 Reason For Not Monitoring: None <---- should display this if SNMP settings are valid Source Of Switch Version: CDP/ISDP Is Monitored ?: true Serial Number of the Device: QTFXXXXXXXXXC RCF Version: RCF BES-53248 v1.14a 1-CLUSTER
Configure um nome de usuário SNMPv3 <snmpv3-user> nos switches Cisco Nexus.
|
|
A partir do ONTAP 9.20.1, é possível configurar a autenticação SHA-512 ou SHA-256 em switches Cisco. |
-
Para sem autenticação:
snmp-server user <snmpv3-user> NoAuth -
Para autenticação MD5/SHA/SHA-256/SHA-512:
snmp-server user <snmpv3-user> auth [md5|sha|sha-256|sha-512] <auth-password> -
Para autenticação MD5/SHA/SHA-256/SHA-512 com criptografia AES/DES*:
snmp-server user <snmpv3-user> AuthEncrypt auth [md5|sha|sha-256|sha-512] <auth-password> priv [aes-128|des] <priv-password>
O seguinte comando configura um nome de usuário SNMPv3 no lado ONTAP:
security login create -user-or-group-name <snmpv3-user> -application snmp -authentication-method usm -remote-switch-ipaddress <address>O seguinte comando estabelece o nome de usuário SNMPv3 com CSHM:
cluster1::*> system switch ethernet modify -device <switch-name> -snmp-version SNMPv3 -community-or-username <snmpv3-user>-
Configure o usuário SNMPv3 no switch para usar autenticação SHA e criptografia AES-128:
(sw1)(Config)# snmp-server user SNMPv3shaAes128 auth sha <auth_password> priv aes-128 <priv_password> (sw1)(Config)# show snmp use SNMPv3shaAes128 User Auth Priv(enforce) Groups Auth Mode acl_filter _ _ __ SNMPv3shaAes128 sha aes-128(no) network-operator Local (sw1)(Config)#
-
Configure o usuário SNMPv3 no lado ONTAP:
cluster1::*> security login create -user-or-group-name SNMPv3shaAes128 -application snmp -authentication-method usm -remote-switch-ipaddress 192.0.2.10 Enter the authoritative entity's EngineID [remote EngineID]: Which authentication protocol do you want to choose (none, md5, sha, sha2-256, sha512) [none]: sha Enter the authentication protocol password (minimum 8 characters long): Enter the authentication protocol password again: Which privacy protocol do you want to choose (none, des, aes128) [none]: aes128 Enter privacy protocol password (minimum 8 characters long): Enter privacy protocol password again:
-
Configure o CSHM para monitorar com o novo usuário SNMPv3:
cluster1::*> system switch ethernet modify -device "sw1" -snmp-version SNMPv3 -community-or-username SNMPv3shaAes128
-
Após aguardar o período de coleta de dados do CSHM, verifique se a opção "Motivo para não monitorar" está definida como "Nenhum".
cluster1::*> system switch ethernet polling-interval show Polling Interval (in minutes): 5 cluster1::*> system switch ethernet show-all -device "sw1" -instance Device Name: sw1 IP Address: 192.0.2.10 SNMP Version: SNMPv3 Is Discovered: true SNMPv2c Community String or SNMPv3 Username: SNMPv3shaAes128 Model Number: N9K-C9336C-FX2 Switch Network: cluster-network Software Version: Cisco NX-OS(tm) Nexus9000 C9336C-FX2, Software (NXOS 64-bit), Version 10.2(4), RELEASE SOFTWARE Copyright (c) 2002-2022 by Cisco Systems, Inc. Compiled 9/20/2022 12:00:00 Reason For Not Monitoring: None <---- should display this if SNMP settings are valid Source Of Switch Version: CDP/ISDP Is Monitored ?: true Serial Number of the Device: FDOXXXXXXX1 RCF Version: RCF NX9336C-FX2 v1.14 1-CLUSTER 2-STORAGE
Configure um nome de usuário SNMPv3 <snmpv3-user> nos switches NVIDIA Cumulus que executam CL 5.4.0:
-
Para sem autenticação:
nv set service snmp-server username <snmpv3-user> auth-none -
Para MD5/SHA autenticação:
nv set service snmp-server username <snmpv3-user> [auth-md5|auth-sha] <auth-password> -
Para autenticação MD5/SHA com criptografia AES/DES:
nv set service snmp-server username <snmpv3-user> [auth-md5|auth-sha] <auth-password> [encrypt-aes|encrypt-des] <priv-password>
O seguinte comando configura um nome de usuário SNMPv3 no lado ONTAP:
security login create -user-or-group-name <snmpv3-user> -application snmp -authentication-method usm -remote-switch-ipaddress <address>O seguinte comando estabelece o nome de usuário SNMPv3 com CSHM:
cluster1::*> system switch ethernet modify -device <switch-name> -snmp-version SNMPv3 -community-or-username <snmpv3-user>-
Configure o usuário SNMPv3 no switch para usar autenticação SHA e criptografia AES-128:
cumulus@sw1:~$ net show snmp status Simple Network Management Protocol (SNMP) Daemon. --------------------------------- ---------------- Current Status active (running) Reload Status enabled Listening IP Addresses all vrf mgmt Main snmpd PID 4318 Version 1 and 2c Community String Configured Version 3 Usernames Not Configured --------------------------------- ---------------- cumulus@sw1:~$ cumulus@sw1:~$ net add snmp-server username SNMPv3shaAes128 auth-sha <auth-password> encrypt-aes <priv-password> cumulus@sw1:~$ net commit --- /etc/snmp/snmpd.conf 2020-08-02 21:09:34.686949282 +0000 +++ /run/nclu/snmp/snmpd.conf 2020-08-11 00:13:51.826126655 +0000 @@ -1,26 +1,28 @@ # Auto-generated config file: do not edit. # agentaddress udp:@mgmt:161 agentxperms 777 777 snmp snmp agentxsocket /var/agentx/master createuser _snmptrapusernameX +createuser SNMPv3shaAes128 SHA <auth-password> AES <priv-password> ifmib_max_num_ifaces 500 iquerysecname _snmptrapusernameX master agentx monitor -r 60 -o laNames -o laErrMessage "laTable" laErrorFlag != 0 pass -p 10 1.3.6.1.2.1.1.1 /usr/share/snmp/sysDescr_pass.py pass_persist 1.2.840.10006.300.43 /usr/share/snmp/ieee8023_lag_pp.py pass_persist 1.3.6.1.2.1.17 /usr/share/snmp/bridge_pp.py pass_persist 1.3.6.1.2.1.31.1.1.1.18 /usr/share/snmp/snmpifAlias_pp.py pass_persist 1.3.6.1.2.1.47 /usr/share/snmp/entity_pp.py pass_persist 1.3.6.1.2.1.99 /usr/share/snmp/entity_sensor_pp.py pass_persist 1.3.6.1.4.1.40310.1 /usr/share/snmp/resq_pp.py pass_persist 1.3.6.1.4.1.40310.2 /usr/share/snmp/cl_drop_cntrs_pp.py pass_persist 1.3.6.1.4.1.40310.3 /usr/share/snmp/cl_poe_pp.py pass_persist 1.3.6.1.4.1.40310.4 /usr/share/snmp/bgpun_pp.py pass_persist 1.3.6.1.4.1.40310.5 /usr/share/snmp/cumulus-status.py pass_persist 1.3.6.1.4.1.40310.6 /usr/share/snmp/cumulus-sensor.py pass_persist 1.3.6.1.4.1.40310.7 /usr/share/snmp/vrf_bgpun_pp.py +rocommunity cshm1! default rouser _snmptrapusernameX +rouser SNMPv3shaAes128 priv sysobjectid 1.3.6.1.4.1.40310 sysservices 72 -rocommunity cshm1! default net add/del commands since the last "net commit" User Timestamp Command --------------- -------------------------- ------------------------------------------------------------------------- SNMPv3shaAes128 2020-08-11 00:13:51.826987 net add snmp-server username SNMPv3shaAes128 auth-sha <auth-password> encrypt-aes <priv-password> cumulus@sw1:~$ cumulus@sw1:~$ net show snmp status Simple Network Management Protocol (SNMP) Daemon. --------------------------------- ---------------- Current Status active (running) Reload Status enabled Listening IP Addresses all vrf mgmt Main snmpd PID 24253 Version 1 and 2c Community String Configured Version 3 Usernames Configured <---- Configured here --------------------------------- ---------------- cumulus@sw1:~$
-
Configure o usuário SNMPv3 no lado ONTAP:
cluster1::*> security login create -user-or-group-name SNMPv3shaAes128 -application snmp -authentication-method usm -remote-switch-ipaddress 192.0.2.10 Enter the authoritative entity's EngineID [remote EngineID]: Which authentication protocol do you want to choose (none, md5, sha, sha2-256, sha512) [none]: sha Enter the authentication protocol password (minimum 8 characters long): Enter the authentication protocol password again: Which privacy protocol do you want to choose (none, des, aes128) [none]: aes128 Enter privacy protocol password (minimum 8 characters long): Enter privacy protocol password again:
-
Configure o CSHM para monitorar com o novo usuário SNMPv3:
cluster1::*> system switch ethernet modify -device "sw1" -snmp-version SNMPv3 -community-or-username SNMPv3shaAes128
-
Após aguardar o período de coleta de dados do CSHM, verifique se a opção "Motivo para não monitorar" está definida como "Nenhum".
cluster1::*> system switch ethernet polling-interval show Polling Interval (in minutes): 5 cluster1::*> system switch ethernet show-all -device "sw1" -instance Device Name: sw1 IP Address: 192.0.2.10 SNMP Version: SNMPv3 Is Discovered: true DEPRECATED-Community String or SNMPv3 Username: - Community String or SNMPv3 Username: SNMPv3shaAes128 Model Number: MSN2100-CB2FC Switch Network: cluster-network Software Version: Cumulus Linux version 5.4.0 running on Mellanox Technologies Ltd. MSN2100 Reason For Not Monitoring: None <---- should display this if SNMP settings are valid Source Of Switch Version: LLDP Is Monitored ?: true Serial Number of the Device: MT2110X06399 RCF Version: RCF MSN2100 v1.14 1-CLUSTER
Configure um nome de usuário SNMPv3 <snmpv3-user> nos switches NVIDIA Cumulus que executam a CLI 5.11.0 e posteriores:
-
Para sem autenticação:
nv set system snmp-server username <snmpv3-user> auth-none -
Para MD5/SHA autenticação:
nv set system snmp-server username <snmpv3-user> [auth-md5|auth-sha] <auth-password> -
Para autenticação MD5/SHA com criptografia AES/DES:
nv set system snmp-server username <snmpv3-user> [auth-md5|auth-sha] <auth-password> [encrypt-aes|encrypt-des] <priv-password>
O seguinte comando configura um nome de usuário SNMPv3 no lado ONTAP:
security login create -user-or-group-name <snmpv3-user> -application snmp -authentication-method usm -remote-switch-ipaddress <address>O seguinte comando estabelece o nome de usuário SNMPv3 com CSHM:
cluster1::*> system switch ethernet modify -device <switch-name> -snmp-version SNMPv3 -community-or-username <snmpv3-user>-
Configure o usuário SNMPv3 no switch para usar autenticação SHA e criptografia AES-128:
cumulus@sw1:~$ nv set system snmp-server username SNMPv3shaAes128 auth-sha <auth-password> encrypt-aes <priv-password> created [rev_id: 14] cumulus@sw1:~$ nv config apply applied_and_saved [rev_id: 14] cumulus@sw1:~$ nv show system snmp-server username SNMPv3shaAes128 applied ---------- --------------------------------------- [auth-sha] $nvsec$836XXXXXXXXXXXXXXXXXXXXXXXXXXXXX -
Configure o usuário SNMPv3 no lado ONTAP:
cluster1::*> security login create -user-or-group-name SNMPv3shaAes128 -application snmp -authentication-method usm -remote-switch-ipaddress 192.0.2.10 Enter the authoritative entity's EngineID [remote EngineID]: Which authentication protocol do you want to choose (none, md5, sha, sha2-256, sha512) [none]: sha Enter the authentication protocol password (minimum 8 characters long): Enter the authentication protocol password again: Which privacy protocol do you want to choose (none, des, aes128) [none]: aes128 Enter privacy protocol password (minimum 8 characters long): Enter privacy protocol password again:
-
Configure o CSHM para monitorar com o novo usuário SNMPv3:
cluster1::*> system switch ethernet modify -device "sw1" -snmp-version SNMPv3 -community-or-username SNMPv3shaAes128
-
Após aguardar o período de coleta de dados do CSHM, verifique se a opção "Motivo para não monitorar" está definida como "Nenhum".
cluster1::*> system switch ethernet polling-interval show Polling Interval (in minutes): 5 cluster1::*> system switch ethernet show-all -device "sw1" -instance Device Name: sw1 IP Address: 192.0.2.10 SNMP Version: SNMPv3 Is Discovered: true DEPRECATED-Community String or SNMPv3 Username: - Community String or SNMPv3 Username: SNMPv3shaAes128 Model Number: MSN2100-CB2FC Switch Network: cluster-network Software Version: Cumulus Linux version 5.11.0 running on Mellanox Technologies Ltd. MSN2100 Reason For Not Monitoring: None <---- should display this if SNMP settings are valid Source Of Switch Version: LLDP Is Monitored ?: true Serial Number of the Device: MT2110X06399 RCF Version: RCF MSN2100 v1.14 1-CLUSTER