Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

SNMPv3 Community String Indexing

Some standard MIBs assume that a particular SNMP entity contains only one instance of the MIB. Thus, the standard MIB does not have any index that allows you to directly access an instance of the MIB. In these cases, a community string indexing is provided to access each instance of the standard MIB. The syntax is [community string]@[instance number].

For example, the Catalyst switch includes one instance of the standard BRIDGE-MIB for each VLAN in the switch. If the read-only community string is public and the read-write community string is private, you can use public@25 to read the BRIDGE-MIB for VLAN 25 and use private@33 to read and write the BRIDGE-MIB for VLAN 33. If just public or private is used, the BRIDGE-MIB for VLAN 1 is accessed.

For SNMPV3 there are NO community strings. So the question is: how do we access the bridge mib for VLANs? Currently, when using SNMPV3, we only see the entries on VLAN 1.

13 REPLIES
Cisco Employee

Re: SNMPv3 Community String Indexing

This is done using SNMP contexts. This is a more standard and reliable way of getting different MIB trees for different subsystems within the same device. However, this does require you to do extra configuration on the device. What device, and what version of code are you using? What SNMP management system are you using? Does it support SNMP contexts?

Community Member

Re: SNMPv3 Community String Indexing

Thanks for the response. This would be done on multiple Cisco switches, 6500/4500/3750/3560/3550 using MG-Soft software and yes, it does support Contexts.

Cisco Employee

Re: SNMPv3 Community String Indexing

All of those switches can run code that supports SNMP contexts. 6500s running recent 12.2SXF or higher code support contexts as do 35xx switches running 12.2(25)SEE or higher. For the 4500, you must be running 12.2(31)SG or higher.

Here is an example config that will give userv3 access to the default branch as well as contexts vlan-1 and vlan-100. See "show snmp context" for a list of all available contexts:

snmp-server group v3group v3 auth

snmp-server group v3group v3 auth context vlan-1

snmp-server group v3group v3 auth context vlan-100

snmp-server user userv3 groupv3 v3 auth md5 userv3pw123

Then you would specify the context name (e.g. vlan-1, vlan-100, etc.) along with the SNMPv3 username and password when querying the dot1dTpFdbTable objects in MG-Soft.

Community Member

Re: SNMPv3 Community String Indexing

Just spent 2 hours figuring this out. Wish I had searched netpro instead of CISCO's main site, which returned near usless results as to how to actually set it up, scattered among several documents VPNs to NMS release notes, that all needed to be pieced together along with some commandline detective work. Sigh.

Does anyone know if there is a way to give an SNMPv3 group access to all contexts? If no context is specified, you cannot get at the bridge-mib for all vlans (vlan-1 seems to default), and we have a whole lot of vlans, so adding a line for every vlan for every SNMP context is quite amazingly inconvenient.

Cisco Employee

Re: SNMPv3 Community String Indexing

Yes, this is inconvenient, but it is the only way to do it for IOS devices. I have developed an IOS TCL scipt that makes this a lot easier, but it currently only works on 6500 and 7600 switches that are running 12.2(18)SXF5 or higher. If there is interest, I will post it.

Community Member

Re: SNMPv3 Community String Indexing

Thanks, I would be very interested in your script if you don't mind. I appreciate your answers as well.

Cisco Employee

Re: SNMPv3 Community String Indexing

Attached. Run tclsh

Community Member

Re: SNMPv3 Community String Indexing

So, where do you put the "vlan-??" in the request? Do you do, "username@vlan-10" to get VLAN 10 MIB Info? Or does the "vlan-10" go somewhere else? "username@10" doesn't work with snmpv3 even though "communityname@10" does work for v2. I added the line that adds the "vlan-10" context to the group, but, "username@10" doesn't work. Is the answer "username@vlan-10"? (I just found this post, but, I'm not where I can test it right now. Hoping against hope that someone might answer this question as I've spent many, many hours trying to figure it out. The documentation on this is basically non-existent).

Community Member

SNMPv3 Community String Indexing

Hey guys,

I know this is a pretty old topic, but i have been trying to locate this information.  Feature Navigator doesn't help much.

I need to know what is the minimum IOS for Catalyst 6500 Supervisor engine 2 to support SNMP group context?

Galactis(config)#snmp-server group capitaland v3 auth ?
 access specify an access-list associated with this group
 notify specify a notify view for the group
 read specify a read view for the group
 write specify a write view for the group
 
 

This switch is running 12.1(22)E1.

Hope to get some help...

Cisco Employee

SNMPv3 Community String Indexing

You need 12.2(33)SXH for context support.

Community Member

SNMPv3 Community String Indexing

Thanks Joe, but I don't think Sup Engine 2 / MSFC2 supports 12.2(33)SXH.

I will try in the lab with this image:

c6sup22-jk2sv-mz.121-27b.E4.bin

Otherwise the latest image for this platform is

s222-entservicesk9_wan-mz.122-18.SXF17b.bin

Cisco Employee

SNMPv3 Community String Indexing

Those images will not work.   If you cannot run 12.2(33)SXH, then you will not get SNMPv3 context support.

Community Member

SNMPv3 Community String Indexing

I see, thanks a mil Joe.

5055
Views
23
Helpful
13
Replies
CreatePlease to create content