Skip to main content
ONTAP MetroCluster

Configure SNMPv3 to monitor the health of MetroCluster IP switches

Contributors netapp-aoife
PDFs

In MetroCluster IP configurations, you can configure SNMPv3 to monitor the health of IP switches.

This procedure shows the generic steps for configuring SNMPv3 on a switch. Some of the switch firmware versions listed might not be supported in a MetroCluster IP configuration.

You must follow the steps for a switch firmware version that is supported in a MetroCluster IP configuration. Refer to the Hardware Universe to verify the supported firmware versions.

Note
About this task

The following commands are used to configure an SNMPv3 username on Broadcom, Cisco, and NVIDIA switches:

Broadcom switches

Configure an SNMPv3 username NETWORK-OPERATOR on Broadcom BES-53248 switches.

Note Beginning with ONTAP 9.20.1, you can configure SHA-512 authentication on Broadcom switches.

  • For no authentication:

    snmp-server user <snmpv3-user> NETWORK-OPERATOR noauth

  • For MD5/SHA/SHA-512 authentication:

    snmp-server user <snmpv3-user> NETWORK-OPERATOR [auth-md5|auth-sha|auth-sha512]

  • For MD5/SHA/SHA-512 authentication with AES/DES encryption:

    snmp-server user <snmpv3-user> NETWORK-OPERATOR [auth-md5|auth-sha|auth-sha512] [priv-aes128|priv-des]

The following command configures an SNMPv3 username on the ONTAP side:

security login create -user-or-group-name <snmpv3-user> -application snmp -authentication-method usm -remote-switch-ipaddress <address>

The following command establishes the SNMPv3 username with CSHM:

cluster1::*> system switch ethernet modify -device <switch-name> -snmp-version SNMPv3 -community-or-username <snmpv3-user>
Example Steps

  1. Set up the SNMPv3 user on the switch to use SHA authentication and AES-128 encryption:

    (sw1)(Config)# snmp-server user SNMPv3shaAes128 NETWORK-OPERATOR auth-sha priv-aes128

(sw1)(Config)# show snmp user snmp SNMPv3shaAes128

     Name            Group Name      Auth       Priv
                                     Meth       Meth    Remote Engine ID                 Remote IP Address
----------------- ------------------ -------    ------ -------------------------------- -------------------------
SNMPv3shaAes128   NETWORK-OPERATOR   SHA        AES128 800XXXXXXXXXXXXXXXXXX1

  2. Set up the SNMPv3 user on the ONTAP side:

    cluster1::*> security login create -user-or-group-name SNMPv3shaAes128 -application snmp -authentication-method usm -remote-switch-ipaddress 192.0.2.10

Enter the authoritative entity's EngineID [remote EngineID]:

Which authentication protocol do you want to choose (none, md5, sha, sha2-256, sha512) [none]: sha

Enter the authentication protocol password (minimum 8 characters long):

Enter the authentication protocol password again:

Which privacy protocol do you want to choose (none, des, aes128) [none]: aes128

Enter privacy protocol password (minimum 8 characters long):

Enter privacy protocol password again:

  3. Configure CSHM to monitor with the new SNMPv3 user:

    cluster1::*> system switch ethernet modify -device "sw1" -snmp-version SNMPv3 -community-or-username SNMPv3shaAes128

  4. After waiting the CSHM polling period, verify that "Reason For Not Monitoring" is set to "None".

    cluster1::*> system switch ethernet polling-interval show
Polling Interval (in minutes): 5

cluster1::*> system switch ethernet show-all -device "sw1" -instance
                                   Device Name: sw1
                                    IP Address: 192.0.2.10
                                  SNMP Version: SNMPv3
                                 Is Discovered: true
DEPRECATED-Community String or SNMPv3 Username: -
           Community String or SNMPv3 Username: SNMPv3shaAes128
                                  Model Number: BES-53248
                                Switch Network: cluster-network
                              Software Version: 3.14.1.1
                     Reason For Not Monitoring: None  <---- should display this if SNMP settings are valid
                      Source Of Switch Version: CDP/ISDP
                                Is Monitored ?: true
                   Serial Number of the Device: QTFXXXXXXXXXC
                                   RCF Version: RCF BES-53248 v1.14a 1-CLUSTER
Cisco switches

Configure an SNMPv3 username <snmpv3-user> on Cisco Nexus switches.

Note Beginning with ONTAP 9.20.1, you can configure SHA-512 or SHA-256 authentication on Cisco switches.

  • For no authentication:

    snmp-server user <snmpv3-user> NoAuth

  • For MD5/SHA/SHA-256/SHA-512 authentication:

    snmp-server user <snmpv3-user> auth [md5|sha|sha-256|sha-512] <auth-password>

  • For MD5/SHA/SHA-256/SHA-512 authentication with AES/DES encryption:

    snmp-server user <snmpv3-user> AuthEncrypt auth [md5|sha|sha-256|sha-512] <auth-password> priv [aes-128|des] <priv-password>

The following command configures an SNMPv3 username on the ONTAP side:

security login create -user-or-group-name <snmpv3-user> -application snmp -authentication-method usm -remote-switch-ipaddress <address>

The following command establishes the SNMPv3 username with CSHM:

cluster1::*> system switch ethernet modify -device <switch-name> -snmp-version SNMPv3 -community-or-username <snmpv3-user>
Example Steps

  1. Set up the SNMPv3 user on the switch to use SHA authentication and AES-128 encryption:

    (sw1)(Config)# snmp-server user SNMPv3shaAes128 auth sha <auth_password> priv aes-128 <priv_password>

(sw1)(Config)# show snmp use  SNMPv3shaAes128
User                Auth      Priv(enforce) Groups              Auth Mode   acl_filter
_                                     _   __
SNMPv3shaAes128     sha       aes-128(no)   network-operator    Local

(sw1)(Config)#

  2. Set up the SNMPv3 user on the ONTAP side:

    cluster1::*> security login create -user-or-group-name SNMPv3shaAes128 -application snmp -authentication-method usm -remote-switch-ipaddress 192.0.2.10

Enter the authoritative entity's EngineID [remote EngineID]:

Which authentication protocol do you want to choose (none, md5, sha, sha2-256, sha512) [none]: sha

Enter the authentication protocol password (minimum 8 characters long):

Enter the authentication protocol password again:

Which privacy protocol do you want to choose (none, des, aes128) [none]: aes128

Enter privacy protocol password (minimum 8 characters long):

Enter privacy protocol password again:

  3. Configure CSHM to monitor with the new SNMPv3 user:

    cluster1::*> system switch ethernet modify -device "sw1" -snmp-version SNMPv3 -community-or-username SNMPv3shaAes128

  4. After waiting the CSHM polling period, verify that "Reason For Not Monitoring" is set to "None".

    cluster1::*> system switch ethernet polling-interval show
Polling Interval (in minutes): 5

cluster1::*> system switch ethernet show-all -device "sw1" -instance
                                   Device Name: sw1
                                    IP Address: 192.0.2.10
                                  SNMP Version: SNMPv3
                                 Is Discovered: true
   SNMPv2c Community String or SNMPv3 Username: SNMPv3shaAes128
                                  Model Number: N9K-C9336C-FX2
                                Switch Network: cluster-network
                              Software Version: Cisco NX-OS(tm) Nexus9000 C9336C-FX2, Software (NXOS 64-bit), Version 10.2(4), RELEASE SOFTWARE Copyright (c) 2002-2022 by Cisco Systems, Inc. Compiled 9/20/2022 12:00:00
                     Reason For Not Monitoring: None  <---- should display this if SNMP settings are valid
                      Source Of Switch Version: CDP/ISDP
                                Is Monitored ?: true
                   Serial Number of the Device: FDOXXXXXXX1
                                   RCF Version: RCF NX9336C-FX2 v1.14 1-CLUSTER 2-STORAGE
NVIDIA - CL 5.4.0

Configure an SNMPv3 username <snmpv3-user> on NVIDIA Cumulus switches running CL 5.4.0:

  • For no authentication:

    nv set service snmp-server username <snmpv3-user> auth-none

  • For MD5/SHA authentication:

    nv set service snmp-server username <snmpv3-user> [auth-md5|auth-sha] <auth-password>

  • For MD5/SHA authentication with AES/DES encryption:

    nv set service snmp-server username <snmpv3-user> [auth-md5|auth-sha] <auth-password> [encrypt-aes|encrypt-des] <priv-password>

The following command configures an SNMPv3 username on the ONTAP side:

security login create -user-or-group-name <snmpv3-user> -application snmp -authentication-method usm -remote-switch-ipaddress <address>

The following command establishes the SNMPv3 username with CSHM:

cluster1::*> system switch ethernet modify -device <switch-name> -snmp-version SNMPv3 -community-or-username <snmpv3-user>
Example Steps

  1. Set up the SNMPv3 user on the switch to use SHA authentication and AES-128 encryption:

    cumulus@sw1:~$ net show snmp status
Simple Network Management Protocol (SNMP) Daemon.
---------------------------------  ----------------
Current Status                     active (running)
Reload Status                      enabled
Listening IP Addresses             all vrf mgmt
Main snmpd PID                     4318
Version 1 and 2c Community String  Configured
Version 3 Usernames                Not Configured
---------------------------------  ----------------
cumulus@sw1:~$
cumulus@sw1:~$ net add snmp-server username SNMPv3shaAes128 auth-sha <auth-password> encrypt-aes <priv-password>
cumulus@sw1:~$ net commit
--- /etc/snmp/snmpd.conf        2020-08-02 21:09:34.686949282 +0000
+++ /run/nclu/snmp/snmpd.conf   2020-08-11 00:13:51.826126655 +0000
@@ -1,26 +1,28 @@
 # Auto-generated config file: do not edit. #
 agentaddress udp:@mgmt:161
 agentxperms 777 777 snmp snmp
 agentxsocket /var/agentx/master
 createuser _snmptrapusernameX
+createuser SNMPv3shaAes128 SHA <auth-password> AES <priv-password>
 ifmib_max_num_ifaces 500
 iquerysecname _snmptrapusernameX
 master agentx
 monitor -r 60 -o laNames -o laErrMessage "laTable" laErrorFlag != 0
 pass -p 10 1.3.6.1.2.1.1.1 /usr/share/snmp/sysDescr_pass.py
 pass_persist 1.2.840.10006.300.43 /usr/share/snmp/ieee8023_lag_pp.py
 pass_persist 1.3.6.1.2.1.17 /usr/share/snmp/bridge_pp.py
 pass_persist 1.3.6.1.2.1.31.1.1.1.18 /usr/share/snmp/snmpifAlias_pp.py
 pass_persist 1.3.6.1.2.1.47 /usr/share/snmp/entity_pp.py
 pass_persist 1.3.6.1.2.1.99 /usr/share/snmp/entity_sensor_pp.py
 pass_persist 1.3.6.1.4.1.40310.1 /usr/share/snmp/resq_pp.py
 pass_persist 1.3.6.1.4.1.40310.2 /usr/share/snmp/cl_drop_cntrs_pp.py
 pass_persist 1.3.6.1.4.1.40310.3 /usr/share/snmp/cl_poe_pp.py
 pass_persist 1.3.6.1.4.1.40310.4 /usr/share/snmp/bgpun_pp.py
 pass_persist 1.3.6.1.4.1.40310.5 /usr/share/snmp/cumulus-status.py
 pass_persist 1.3.6.1.4.1.40310.6 /usr/share/snmp/cumulus-sensor.py
 pass_persist 1.3.6.1.4.1.40310.7 /usr/share/snmp/vrf_bgpun_pp.py
+rocommunity cshm1! default
 rouser _snmptrapusernameX
+rouser SNMPv3shaAes128 priv
 sysobjectid 1.3.6.1.4.1.40310
 sysservices 72
-rocommunity cshm1! default


net add/del commands since the last "net commit"

User             Timestamp                   Command
---------------  --------------------------  -------------------------------------------------------------------------
SNMPv3shaAes128  2020-08-11 00:13:51.826987  net add snmp-server username SNMPv3shaAes128 auth-sha <auth-password> encrypt-aes <priv-password>

cumulus@sw1:~$
cumulus@sw1:~$ net show snmp status
Simple Network Management Protocol (SNMP) Daemon.
---------------------------------  ----------------
Current Status                     active (running)
Reload Status                      enabled
Listening IP Addresses             all vrf mgmt
Main snmpd PID                     24253
Version 1 and 2c Community String  Configured
Version 3 Usernames                Configured     <---- Configured here
---------------------------------  ----------------
cumulus@sw1:~$

  2. Set up the SNMPv3 user on the ONTAP side:

    cluster1::*> security login create -user-or-group-name SNMPv3shaAes128 -application snmp -authentication-method usm -remote-switch-ipaddress 192.0.2.10

Enter the authoritative entity's EngineID [remote EngineID]:

Which authentication protocol do you want to choose (none, md5, sha, sha2-256, sha512) [none]: sha

Enter the authentication protocol password (minimum 8 characters long):

Enter the authentication protocol password again:

Which privacy protocol do you want to choose (none, des, aes128) [none]: aes128

Enter privacy protocol password (minimum 8 characters long):

Enter privacy protocol password again:

  3. Configure CSHM to monitor with the new SNMPv3 user:

    cluster1::*> system switch ethernet modify -device "sw1" -snmp-version SNMPv3 -community-or-username SNMPv3shaAes128

  4. After waiting the CSHM polling period, verify that "Reason For Not Monitoring" is set to "None".

    cluster1::*> system switch ethernet polling-interval show
Polling Interval (in minutes): 5

cluster1::*> system switch ethernet show-all -device "sw1" -instance
                                   Device Name: sw1
                                    IP Address: 192.0.2.10
                                  SNMP Version: SNMPv3
                                 Is Discovered: true
DEPRECATED-Community String or SNMPv3 Username: -
           Community String or SNMPv3 Username: SNMPv3shaAes128
                                  Model Number: MSN2100-CB2FC
                                Switch Network: cluster-network
                              Software Version: Cumulus Linux version 5.4.0 running on Mellanox Technologies Ltd. MSN2100
                     Reason For Not Monitoring: None  <---- should display this if SNMP settings are valid
                      Source Of Switch Version: LLDP
                                Is Monitored ?: true
                   Serial Number of the Device: MT2110X06399
                                   RCF Version: RCF MSN2100 v1.14 1-CLUSTER
NVIDIA - CL 5.11.0+

Configure an SNMPv3 username <snmpv3-user> on NVIDIA Cumulus switches running CLI 5.11.0 and later:

  • For no authentication:

    nv set system snmp-server username <snmpv3-user> auth-none

  • For MD5/SHA authentication:

    nv set system snmp-server username <snmpv3-user> [auth-md5|auth-sha] <auth-password>

  • For MD5/SHA authentication with AES/DES encryption:

    nv set system snmp-server username <snmpv3-user> [auth-md5|auth-sha] <auth-password> [encrypt-aes|encrypt-des] <priv-password>

The following command configures an SNMPv3 username on the ONTAP side:

security login create -user-or-group-name <snmpv3-user> -application snmp -authentication-method usm -remote-switch-ipaddress <address>

The following command establishes the SNMPv3 username with CSHM:

cluster1::*> system switch ethernet modify -device <switch-name> -snmp-version SNMPv3 -community-or-username <snmpv3-user>
Example Steps

  1. Set up the SNMPv3 user on the switch to use SHA authentication and AES-128 encryption:

    cumulus@sw1:~$ nv set system snmp-server username SNMPv3shaAes128 auth-sha <auth-password> encrypt-aes <priv-password>
created [rev_id: 14]
cumulus@sw1:~$ nv config apply
applied_and_saved [rev_id: 14]
cumulus@sw1:~$ nv show system snmp-server username SNMPv3shaAes128
            applied
----------  ---------------------------------------
[auth-sha]  $nvsec$836XXXXXXXXXXXXXXXXXXXXXXXXXXXXX

  2. Set up the SNMPv3 user on the ONTAP side:

    cluster1::*> security login create -user-or-group-name SNMPv3shaAes128 -application snmp -authentication-method usm -remote-switch-ipaddress 192.0.2.10

Enter the authoritative entity's EngineID [remote EngineID]:

Which authentication protocol do you want to choose (none, md5, sha, sha2-256, sha512) [none]: sha

Enter the authentication protocol password (minimum 8 characters long):

Enter the authentication protocol password again:

Which privacy protocol do you want to choose (none, des, aes128) [none]: aes128

Enter privacy protocol password (minimum 8 characters long):

Enter privacy protocol password again:

  3. Configure CSHM to monitor with the new SNMPv3 user:

    cluster1::*> system switch ethernet modify -device "sw1" -snmp-version SNMPv3 -community-or-username SNMPv3shaAes128

  4. After waiting the CSHM polling period, verify that "Reason For Not Monitoring" is set to "None".

    cluster1::*> system switch ethernet polling-interval show
Polling Interval (in minutes): 5

cluster1::*> system switch ethernet show-all -device "sw1" -instance
                                   Device Name: sw1
                                    IP Address: 192.0.2.10
                                  SNMP Version: SNMPv3
                                 Is Discovered: true
DEPRECATED-Community String or SNMPv3 Username: -
           Community String or SNMPv3 Username: SNMPv3shaAes128
                                  Model Number: MSN2100-CB2FC
                                Switch Network: cluster-network
                              Software Version: Cumulus Linux version 5.11.0 running on Mellanox Technologies Ltd. MSN2100
                     Reason For Not Monitoring: None  <---- should display this if SNMP settings are valid
                      Source Of Switch Version: LLDP
                                Is Monitored ?: true
                   Serial Number of the Device: MT2110X06399
                                   RCF Version: RCF MSN2100 v1.14 1-CLUSTER