topic Re: How to enable SNMP on AP305C IQ Engine ? in ExtremeCloud IQ

How to enable SNMP on AP305C IQ Engine ?

MikeM1 — Fri, 25 Mar 2022 14:37:14 GMT

Hi there, I am trying to enable SNMP on AP305C IPaddress: 10.1.15.158.

I am following the next manual.

How To: How to configure SNMP on ExtremeCloud IQ (XIQ) | Extreme Portal

But after passing all these steps SNMPwalk returns a timeout.

~$ snmpwalk -v 3 -On -u username -l authPriv -a MD5 -A 'password' -x DES -X 'password' -m ALL 10.1.15.158 1.3.6.1.4.1.1916
~$ snmpwalk: Timeout

Could you please advise how to make it work as expected?

Re: How to enable SNMP on AP305C IQ Engine ?

Nick_Moore — Fri, 01 Apr 2022 20:07:20 GMT

Please confirm you have the following configured:

port type that enables SNMP in device template for AP305C, and the AP shows that port type and template in Manage > Devices > Edit > Configure > Interface Settings
traffic filter in Network Policy > Additional Settings enabled and set to enable SNMP
SNMP server settings use desired user name and password for v3 and is set for Get or Get & Trap, and the IP is correct

Re: How to enable SNMP on AP305C IQ Engine ?

RomanG — Wed, 06 Apr 2022 20:46:05 GMT

Hi again,

Thank you very much for the replies. I have tried this but I am still getting timeout and no snmp data:

deployer@Tetherbox-685ee377f581ff25de58:~$ snmpwalk -v3 -On -u tether -l authPriv -a MD5 -A 'tethertether' -x DES -X 'tethertether' -m ALL 10.1.15.158 1.3.6.1.4.1.1916
snmpwalk: Timeout

deployer@Tetherbox-685ee377f581ff25de58:~$ sudo nmap -sP 10.1.15.158
Starting Nmap 7.80 ( https://nmap.org ) at 2022-04-06 18:44 BST
Nmap scan report for 10.1.15.158
Host is up (0.00024s latency).
MAC Address: 90:B8:32:71:F4:C0 (Extreme Networks, Inc.)
Nmap done: 1 IP address (1 host up) scanned in 0.11 seconds

Here are some screenshots of my setup:

I have created a non-default device template to enable SNMP as described in the howto manual that I mentioned above. Here is a screenshot of Manage > Devices > Edit > Configure > Interface Settings

Custom interface template:

Traffic filter in Network Policy > Additional Settings enabled and set to enable SNMP

Device info:

SNMP settings v3 (I also tried v2, same results)

I made sure to apply the configuration and wait for the access point to reboot:

What am I missing?

Re: How to enable SNMP on AP305C IQ Engine ?

RomanG — Wed, 06 Apr 2022 20:55:32 GMT

Whoops, I noticed the image quality is very low, attaching again:

Re: How to enable SNMP on AP305C IQ Engine ?

Nick_Moore — Wed, 06 Apr 2022 21:32:17 GMT

Thank you for that. I did not see a screen shot of the traffic filter from the additional settings of the network policy. Apologies if I missed it. Do you have SNMP enabled there, too? Are you testing from a device that is in the range you configured for the SNMP server? Please provide the output of "show run | include snmp".

Re: How to enable SNMP on AP305C IQ Engine ?

RomanG — Wed, 06 Apr 2022 21:40:00 GMT

Here is the traffic filter:
Here is screenshot of snmp, my Linux server IP is 10.1.15.159 (where I am trying to run snmpwalk):
Does the above look right?

How do I share output of "show run | include snmp" -- where do I run that?

Re: How to enable SNMP on AP305C IQ Engine ?

DeVoID — Wed, 06 Apr 2022 22:04:12 GMT

Stupid question, but you do have that AP device template associated in your network policy right? because if you dont, it will get its info from the out-of-the-box AP template which is unchangeable. For changes to work, your AP template must be in your network policy.

Should be like this, but with your AP template in it:

Hope this helps.

Jason.

Re: How to enable SNMP on AP305C IQ Engine ?

RomanG — Wed, 06 Apr 2022 22:10:36 GMT

Yes, my SNMP template:

Re: How to enable SNMP on AP305C IQ Engine ?

RomanG — Wed, 06 Apr 2022 22:25:18 GMT

I'm trying to set up telnet and ssh to run commands - I set a username and password but I am not able to login to ssh and telnet is not responding at all (port 23), despite me enabling telnet everywhere I have enabled SNMP.

root@Tetherbox-685ee377f581ff25de58:~# sudo nmap 10.1.15.158
Starting Nmap 7.80 ( https://nmap.org ) at 2022-04-06 20:25 BST
Nmap scan report for 10.1.15.158
Host is up (0.00017s latency).
Not shown: 994 closed ports
PORT     STATE    SERVICE
22/tcp   open     ssh
23/tcp   filtered telnet
80/tcp   open     http
161/tcp  filtered snmp
443/tcp  open     https
3007/tcp open     lotusmtap

I found in the interface that SSH requires that I upgrade? - is there no way to use ssh in the free version? - can I use telnet with the free version?

Silly question, but I can use SNMP with the free version, or maybe I need to upgrade and this is why it's not giving me any data?

Re: How to enable SNMP on AP305C IQ Engine ?

RomanG — Wed, 06 Apr 2022 22:39:10 GMT

I managed to ssh! - but I am not seeing anything for include snmp:

root@Tetherbox-685ee377f581ff25de58:~# ssh admin@10.1.15.158
admin@10.1.15.158's password:
Copyright (c) 2006-2021 Extreme Networks, Inc.
AH-71f4c0#show run
security mac-filter VHM-PJLZPELC default permit
security mac-filter RTS-STAFF default permit
security mac-filter RTS-GUEST default permit
security mac-filter RTS-WIFI default permit
radio profile radio_ng_11ax-2g
radio profile radio_ng_11ax-2g phymode 11ax-2g
radio profile radio_ng_11ax-2g acsp access channel-auto-select time-range 01:00 04:00
radio profile radio_ng_11ax-2g interference-map enable
radio profile radio_ng_11ax-2g interference-map cu-threshold 35
radio profile radio_ng_11ax-2g interference-map crc-err-threshold 35
radio profile radio_ng_11ax-2g short-guard-interval
radio profile radio_ng_11ax-2g benchmark phymode 11b rate 11 success 60 usage 50
radio profile radio_ng_11ax-2g benchmark phymode 11b rate 5.5 success 70 usage 50
radio profile radio_ng_11ax-2g benchmark phymode 11g rate 36 success 70 usage 50
radio profile radio_ng_11ax-2g benchmark phymode 11g rate 24 success 80 usage 50
radio profile radio_ng_11ax-2g benchmark phymode 11a rate 36 success 70 usage 50
radio profile radio_ng_11ax-2g benchmark phymode 11a rate 24 success 80 usage 50
radio profile radio_ng_11ax-2g benchmark phymode 11n rate mcs4/2 success 80 usage 50
radio profile radio_ng_11ax-2g benchmark phymode 11n rate 54 success 70 usage 50
radio profile radio_ng_11ax-2g benchmark phymode 11ac rate mcs2/2 success 80 usage 50
radio profile radio_ng_11ax-2g benchmark phymode 11ac rate 54 success 70 usage 50
radio profile radio_ng_11ax-2g benchmark phymode 11ax rate mcs2/2 success 80 usage 50
radio profile radio_ng_11ax-2g benchmark phymode 11ax rate 54 success 70 usage 50
radio profile radio_ng_11ax-2g frameburst
radio profile radio_ng_11ax-5g
radio profile radio_ng_11ax-5g phymode 11ax-5g
radio profile radio_ng_11ax-5g acsp access channel-auto-select time-range 01:00 04:00
radio profile radio_ng_11ax-5g interference-map enable
radio profile radio_ng_11ax-5g interference-map cu-threshold 35
radio profile radio_ng_11ax-5g interference-map crc-err-threshold 35
radio profile radio_ng_11ax-5g short-guard-interval
radio profile radio_ng_11ax-5g benchmark phymode 11b rate 11 success 60 usage 50
radio profile radio_ng_11ax-5g benchmark phymode 11b rate 5.5 success 70 usage 50
radio profile radio_ng_11ax-5g benchmark phymode 11g rate 36 success 70 usage 50
radio profile radio_ng_11ax-5g benchmark phymode 11g rate 24 success 80 usage 50
radio profile radio_ng_11ax-5g benchmark phymode 11a rate 36 success 70 usage 50
radio profile radio_ng_11ax-5g benchmark phymode 11a rate 24 success 80 usage 50
radio profile radio_ng_11ax-5g benchmark phymode 11n rate mcs4/2 success 80 usage 50
radio profile radio_ng_11ax-5g benchmark phymode 11n rate 54 success 70 usage 50
radio profile radio_ng_11ax-5g benchmark phymode 11ac rate mcs2/2 success 80 usage 50
radio profile radio_ng_11ax-5g benchmark phymode 11ac rate 54 success 70 usage 50
radio profile radio_ng_11ax-5g benchmark phymode 11ax rate mcs2/2 success 80 usage 50
radio profile radio_ng_11ax-5g benchmark phymode 11ax rate 54 success 70 usage 50
radio profile radio_ng_11ax-5g frameburst
security-object RTS-STAFF
security-object RTS-STAFF security protocol-suite wpa3-sae ascii-key ***
security-object RTS-STAFF security protocol-suite wpa3-sae mfp optional
security-object RTS-STAFF default-user-profile-attr 3
security-object RTS-GUEST
security-object RTS-GUEST security protocol-suite wpa3-sae ascii-key ***
security-object RTS-GUEST security protocol-suite wpa3-sae mfp optional
security-object RTS-GUEST default-user-profile-attr 2
security-object RTS-WIFI
security-object RTS-WIFI security protocol-suite wpa3-sae ascii-key ***
security-object RTS-WIFI security protocol-suite wpa3-sae mfp optional
security-object RTS-WIFI default-user-profile-attr 1
ssid RTS-STAFF
ssid RTS-STAFF security-object RTS-STAFF
ssid RTS-STAFF security mac-filter RTS-STAFF
ssid RTS-STAFF 11g-rate-set 11-basic 6 9 12 18 24 36 48 54
no ssid RTS-STAFF wnm bss-transition disassociation-imminent enable
ssid RTS-GUEST
ssid RTS-GUEST security-object RTS-GUEST
ssid RTS-GUEST security mac-filter RTS-GUEST
ssid RTS-GUEST 11g-rate-set 11-basic 6 9 12 18 24 36 48 54
no ssid RTS-GUEST wnm bss-transition disassociation-imminent enable
ssid RTS-WIFI
ssid RTS-WIFI security-object RTS-WIFI
ssid RTS-WIFI security mac-filter RTS-WIFI
ssid RTS-WIFI 11g-rate-set 11-basic 6 9 12 18 24 36 48 54
no ssid RTS-WIFI wnm bss-transition disassociation-imminent enable
hive VHM-PJLZPELC
hive VHM-PJLZPELC security mac-filter VHM-PJLZPELC
hive VHM-PJLZPELC password ***
presence profile RTSWIFI
presence profile RTSWIFI aging-time 60
presence profile RTSWIFI trap-interval 60
presence profile RTSWIFI aggr-interval 60
interface eth0 native-vlan 115
no interface eth0 link-discovery cdp
interface wifi0 radio profile radio_ng_11ax-2g
interface wifi0 presence profile RTSWIFI
interface wifi1 radio profile radio_ng_11ax-5g
interface wifi1 mode access
interface wifi1 presence profile RTSWIFI
interface mgt0 hive VHM-PJLZPELC
interface mgt0 vlan 115
interface mgt0 native-vlan 115
interface wifi0 ssid RTS-STAFF
interface wifi0 ssid RTS-GUEST
interface wifi0 ssid RTS-WIFI
interface wifi1 ssid RTS-STAFF
no system led power-saving-mode
kddr enable
lldp
admin root-admin admin password ***
interface mgt0 ip 10.1.15.158 255.255.255.0
ip route net 0.0.0.0 0.0.0.0 gateway 10.1.15.1
no interface mgt0 dhcp client
dns server-ip 10.1.10.5
dns server-ip 10.1.10.6 second
dns domain-name ralph.local
ntp server 0.aerohive.pool.ntp.org
ntp server 1.aerohive.pool.ntp.org second
ntp server 2.aerohive.pool.ntp.org third
ntp server 3.aerohive.pool.ntp.org fourth
clock time-zone daylight-saving-time 03-27 00:59:59 10-30 01:59:59
config rollback enable
capwap client server name nl-gcp-cws-3.extremecloudiq.com
capwap client server backup name nl-gcp-cwm.extremecloudiq.com
capwap client dtls hm-defined-passphrase *** key-id 1
capwap client vhm-name VHM-PJLZPELC
no capwap client dtls negotiation enable
user-profile RTS-STAFF qos-policy def-user-qos vlan-id 136 attribute 3
user-profile RTS-WIFI qos-policy def-user-qos vlan-id 128 attribute 1
user-profile RTS-Guest qos-policy def-user-qos vlan-id 124 attribute 2
application reporting auto
application reporting upload https://nl-gcp.extremecloudiq.com:443/afs-webapp/l7report/252692/ time-window 15 admin VHM-PJLZPELC password *** basic
AH-71f4c0#show run | include snmp
AH-71f4c0#

Re: How to enable SNMP on AP305C IQ Engine ?

Nick_Moore — Wed, 06 Apr 2022 22:59:08 GMT

You likely have some device level settings overriding what would be set by the template. From Manage > Devices, select the AP(s), click Actions > Revert Device to Template Defaults, follow the steps there, then push a complete configuration to the device(s).

Re: How to enable SNMP on AP305C IQ Engine ?

RomanG — Wed, 06 Apr 2022 23:05:13 GMT

Alright, done:

Now it shows this, still no SNMP - any ideas?

root@Tetherbox-685ee377f581ff25de58:~# ssh admin@10.1.15.158
admin@10.1.15.158's password:
Copyright (c) 2006-2021 Extreme Networks, Inc.
AH-71f4c0#show run
security mac-filter VHM-PJLZPELC default permit
security mac-filter RTS-STAFF default permit
security mac-filter RTS-GUEST default permit
security mac-filter RTS-WIFI default permit
radio profile radio_ng_11ax-2g
radio profile radio_ng_11ax-2g phymode 11ax-2g
radio profile radio_ng_11ax-2g acsp access channel-auto-select time-range 01:00 04:00
radio profile radio_ng_11ax-2g interference-map enable
radio profile radio_ng_11ax-2g interference-map cu-threshold 35
radio profile radio_ng_11ax-2g interference-map crc-err-threshold 35
radio profile radio_ng_11ax-2g short-guard-interval
radio profile radio_ng_11ax-2g benchmark phymode 11b rate 11 success 60 usage 50
radio profile radio_ng_11ax-2g benchmark phymode 11b rate 5.5 success 70 usage 50
radio profile radio_ng_11ax-2g benchmark phymode 11g rate 36 success 70 usage 50
radio profile radio_ng_11ax-2g benchmark phymode 11g rate 24 success 80 usage 50
radio profile radio_ng_11ax-2g benchmark phymode 11a rate 36 success 70 usage 50
radio profile radio_ng_11ax-2g benchmark phymode 11a rate 24 success 80 usage 50
radio profile radio_ng_11ax-2g benchmark phymode 11n rate mcs4/2 success 80 usage 50
radio profile radio_ng_11ax-2g benchmark phymode 11n rate 54 success 70 usage 50
radio profile radio_ng_11ax-2g benchmark phymode 11ac rate mcs2/2 success 80 usage 50
radio profile radio_ng_11ax-2g benchmark phymode 11ac rate 54 success 70 usage 50
radio profile radio_ng_11ax-2g benchmark phymode 11ax rate mcs2/2 success 80 usage 50
radio profile radio_ng_11ax-2g benchmark phymode 11ax rate 54 success 70 usage 50
radio profile radio_ng_11ax-2g frameburst
radio profile radio_ng_11ax-5g
radio profile radio_ng_11ax-5g phymode 11ax-5g
radio profile radio_ng_11ax-5g acsp access channel-auto-select time-range 01:00 04:00
radio profile radio_ng_11ax-5g interference-map enable
radio profile radio_ng_11ax-5g interference-map cu-threshold 35
radio profile radio_ng_11ax-5g interference-map crc-err-threshold 35
radio profile radio_ng_11ax-5g short-guard-interval
radio profile radio_ng_11ax-5g benchmark phymode 11b rate 11 success 60 usage 50
radio profile radio_ng_11ax-5g benchmark phymode 11b rate 5.5 success 70 usage 50
radio profile radio_ng_11ax-5g benchmark phymode 11g rate 36 success 70 usage 50
radio profile radio_ng_11ax-5g benchmark phymode 11g rate 24 success 80 usage 50
radio profile radio_ng_11ax-5g benchmark phymode 11a rate 36 success 70 usage 50
radio profile radio_ng_11ax-5g benchmark phymode 11a rate 24 success 80 usage 50
radio profile radio_ng_11ax-5g benchmark phymode 11n rate mcs4/2 success 80 usage 50
radio profile radio_ng_11ax-5g benchmark phymode 11n rate 54 success 70 usage 50
radio profile radio_ng_11ax-5g benchmark phymode 11ac rate mcs2/2 success 80 usage 50
radio profile radio_ng_11ax-5g benchmark phymode 11ac rate 54 success 70 usage 50
radio profile radio_ng_11ax-5g benchmark phymode 11ax rate mcs2/2 success 80 usage 50
radio profile radio_ng_11ax-5g benchmark phymode 11ax rate 54 success 70 usage 50
radio profile radio_ng_11ax-5g frameburst
security-object RTS-STAFF
security-object RTS-STAFF security protocol-suite wpa3-sae ascii-key ***
security-object RTS-STAFF security protocol-suite wpa3-sae mfp optional
security-object RTS-STAFF default-user-profile-attr 3
security-object RTS-GUEST
security-object RTS-GUEST security protocol-suite wpa3-sae ascii-key ***
security-object RTS-GUEST security protocol-suite wpa3-sae mfp optional
security-object RTS-GUEST default-user-profile-attr 2
security-object RTS-WIFI
security-object RTS-WIFI security protocol-suite wpa3-sae ascii-key ***
security-object RTS-WIFI security protocol-suite wpa3-sae mfp optional
security-object RTS-WIFI default-user-profile-attr 1
ssid RTS-STAFF
ssid RTS-STAFF security-object RTS-STAFF
ssid RTS-STAFF security mac-filter RTS-STAFF
ssid RTS-STAFF 11g-rate-set 11-basic 6 9 12 18 24 36 48 54
no ssid RTS-STAFF wnm bss-transition disassociation-imminent enable
ssid RTS-GUEST
ssid RTS-GUEST security-object RTS-GUEST
ssid RTS-GUEST security mac-filter RTS-GUEST
ssid RTS-GUEST 11g-rate-set 11-basic 6 9 12 18 24 36 48 54
no ssid RTS-GUEST wnm bss-transition disassociation-imminent enable
ssid RTS-WIFI
ssid RTS-WIFI security-object RTS-WIFI
ssid RTS-WIFI security mac-filter RTS-WIFI
ssid RTS-WIFI 11g-rate-set 11-basic 6 9 12 18 24 36 48 54
no ssid RTS-WIFI wnm bss-transition disassociation-imminent enable
hive VHM-PJLZPELC
hive VHM-PJLZPELC security mac-filter VHM-PJLZPELC
hive VHM-PJLZPELC password ***
presence profile RTSWIFI
presence profile RTSWIFI aging-time 60
presence profile RTSWIFI trap-interval 60
presence profile RTSWIFI aggr-interval 60
interface eth0 native-vlan 115
no interface eth0 link-discovery cdp
interface wifi0 radio profile radio_ng_11ax-2g
interface wifi0 presence profile RTSWIFI
interface wifi1 radio profile radio_ng_11ax-5g
interface wifi1 mode access
interface wifi1 presence profile RTSWIFI
interface mgt0 hive VHM-PJLZPELC
interface mgt0 vlan 115
interface mgt0 native-vlan 115
interface wifi0 ssid RTS-STAFF
interface wifi0 ssid RTS-GUEST
interface wifi0 ssid RTS-WIFI
interface wifi1 ssid RTS-STAFF
no system led power-saving-mode
kddr enable
lldp
admin root-admin admin password ***
interface mgt0 ip 10.1.15.158 255.255.255.0
ip route net 0.0.0.0 0.0.0.0 gateway 10.1.15.1
no interface mgt0 dhcp client
dns server-ip 10.1.10.5
dns server-ip 10.1.10.6 second
dns domain-name ralph.local
ntp server 0.aerohive.pool.ntp.org
ntp server 1.aerohive.pool.ntp.org second
ntp server 2.aerohive.pool.ntp.org third
ntp server 3.aerohive.pool.ntp.org fourth
clock time-zone daylight-saving-time 03-27 00:59:59 10-30 01:59:59
config rollback enable
capwap client server name nl-gcp-cws-3.extremecloudiq.com
capwap client server backup name nl-gcp-cwm.extremecloudiq.com
capwap client dtls hm-defined-passphrase *** key-id 1
capwap client vhm-name VHM-PJLZPELC
no capwap client dtls negotiation enable
user-profile RTS-STAFF qos-policy def-user-qos vlan-id 136 attribute 3
user-profile RTS-WIFI qos-policy def-user-qos vlan-id 128 attribute 1
user-profile RTS-Guest qos-policy def-user-qos vlan-id 124 attribute 2
application reporting auto
application reporting upload https://nl-gcp.extremecloudiq.com:443/afs-webapp/l7report/252692/ time-window 15 admin VHM-PJLZPELC password *** basic
AH-71f4c0#show run | include snmp
AH-71f4c0#

Re: How to enable SNMP on AP305C IQ Engine ?

RomanG — Wed, 06 Apr 2022 23:27:02 GMT

Also this:

AH-71f4c0#show snmp
Syslocation:        change_me
Syscontact:         admin@aerohive.com
Community numbers:  1

Re: How to enable SNMP on AP305C IQ Engine ?

Nick_Moore — Thu, 07 Apr 2022 00:37:11 GMT

Please add my colleague Sam as an external admin with the Administrator role and update this thread when it is done. The email you would add is spirok@extremenetworks.com.

Re: How to enable SNMP on AP305C IQ Engine ?

RomanG — Thu, 07 Apr 2022 00:45:22 GMT

Done, added spirok@extremenetworks.com as an admin - apologies in advance if I did something stupid and that is why it's not working!

Re: How to enable SNMP on AP305C IQ Engine ?

SamPirok — Thu, 07 Apr 2022 01:06:21 GMT

Hi Roman, thanks for adding me to your XIQ instance. I reviewed your setup with Nick and the configuration looks good. We see that the SNMP configuration is reflected in the delta audit on the AP, which just means it's waiting to be pushed out. We did notice that the native VLAN in your SNMP set up is different than the native VLAN currently in use. It's possible that when you are trying to push the SNMP configuration out to your AP, it's attempting to switch to the new Native VLAN but isn't able to pass traffic on that VLAN, which would cause it to lose connectivity with the network and revert the configuration change back to what it was before the latest update push. If you could confirm that the switch ports are all configured to support the new Native VLAN, that would help.

Also, the SNMP location will be picked up from the location you assign to the AP. You can assign the AP location in the ML Insights> Network 360 Monitor page.

Hope this helps! Let us know if you need any assistance checking your ports for the new native VLAN.

Re: How to enable SNMP on AP305C IQ Engine ?

RomanG — Thu, 07 Apr 2022 01:32:45 GMT

Thank you for looking, yes, the ports on the switch are configured, what should I do next to force the config? - is it just assigning a location or anything else?

Re: How to enable SNMP on AP305C IQ Engine ?

Nick_Moore — Thu, 07 Apr 2022 02:16:27 GMT

Your options would be:

to match the management and native VLANs in the additional settings of the network policy and the native VLAN in your port type to match the true VLANs on the switch, or
leave the VLANs set as they are in the network policy and match the native on the port type to them.

Currently, your management and native are set to the same value, which makes that VLAN an untagged VLAN leaving the AP. The traffic then gets tagged with the native/untagged VLAN on the switch port. For example, if you leave it at the default of 1 and 1 for management and native, but the native on the switch port is 5, it will flow through your network as VLAN 5 while the AP would report it as VLAN 1.

Re: How to enable SNMP on AP305C IQ Engine ?

RomanG — Thu, 07 Apr 2022 02:18:54 GMT

Also, when I go to Network 360 Monitor, I don't see any devices, I created a new location "Test":

Re: How to enable SNMP on AP305C IQ Engine ?

Nick_Moore — Thu, 07 Apr 2022 02:23:02 GMT

You would need to assign the AP to that location and push the configuration. Then the AP should show on the floor plan you assigned it to.