Skip to main content

Remove SHA-512 SNMPv3 users before reverting from ONTAP 9.20.1

Contributors netapp-andreajost
PDFs

Beginning with ONTAP 9.20.1, you can create SNMPv3 users that use SHA-512 authentication. ONTAP versions earlier than 9.20.1 do not support SHA-512 authentication, so ONTAP blocks the revert if any SNMPv3 users with SHA-512 authentication exist. Before you revert, delete these users and recreate them with a supported authentication protocol.

Steps

  1. Display the SNMPv3 users that use SHA-512 authentication:

    security snmpusers -authmethod usm -authprotocol sha512

  2. Delete each SHA-512 user:

    security login delete -vserver <vserver_name> -user-or-group-name <user_name> -application snmp -authentication-method usm

  3. If you still need the users, recreate them with a supported authentication protocol, such as sha or sha2-256:

    security login create -vserver <vserver_name> -user-or-group-name <user_name> -application snmp -authentication-method usm

    If the user monitors a switch, include the -remote-switch-ipaddress parameter with the IP address of the switch:

    security login create -user-or-group-name <user_name> -application snmp -authentication-method usm -remote-switch-ipaddress <switch_ip_address>

    Learn more about configuring SNMPv3 users.

  4. If any Ethernet switches used the deleted SHA-512 users for monitoring, update each switch to use the recreated user:

    system switch ethernet modify -device <switch_name> -snmp-version SNMPv3 -community-or-username <snmp_user_name>

    Learn more about system switch ethernet modify in the ONTAP command reference.

    For more information about SNMPv3 for the Ethernet switch health monitor (CSHM), including how to configure the Ethernet switches, see Configure SNMPv3 for Ethernet switch health monitoring.