topic Re: VSP - unable send traps to XMC SNMPv3 in Network Architecture & Design

VSP - unable send traps to XMC SNMPv3

EF — Thu, 06 Jun 2019 20:13:30 GMT

Hi team,

I´m unable recive traps in the XMC server form VSPs, and in the VSP logs I can see:

SNMP ERROR Failed to create trap (Reason=Failed to create v3 trap) for host A.B.C.D:162

Any idea?

Regards,

EF

Re: VSP - unable send traps to XMC SNMPv3

Zdeněk_Pala — Fri, 07 Jun 2019 00:22:00 GMT

in some versions of VSP commands must be entered in following order.

Here are CLI commands:
VOSS02:1(config)#snmp-server authentication-trap enable
VOSS02:1(config)#snmp-server contact MasterOfUniverse
VOSS02:1(config)#snmp-server force-iphdr-sender enable
VOSS02:1(config)#snmp-server location MiddleOfTheWorld
VOSS02:1(config)#snmp-server group "RWgroup" "" auth-priv read-view root write-view root notify-view root
VOSS02:1(config)#snmp-server user snmpuser group RWgroup md5 snmpauthcred des snmpprivcred

VOSS02:1(config)#snmp-server sender-ip 192.168.130.30 192.168.130.16
VOSS02:1(config)#snmp-server user engine-id 0x80:00:1f:88:80:cb:4b:36:51:8f:1b??5a snmpuser md5 snmpauthcred des snmpprivcred
VOSS02:1(config)#snmp-server host 192.168.130.30 v3 authpriv snmpuser inform

Where:
0x80:00:1f:88:80:cb:4b:36:51:8f:1b??5a = SNMP engine ID of the XMC
192.168.130.30 = IP address of the XMC
192.168.130.16 = IP address of the VSP

While the snmpuser is used with the same credentials for both SNMP queries and for SNMP informs. Both with authpriv.

Re: VSP - unable send traps to XMC SNMPv3

Anonymous — Wed, 20 Nov 2019 23:10:11 GMT

Just seeing if anyone has a working SNMPv3 configuration for an ERS 3600 series switch.

Typically you would need to configure three elements:

Group
Access
User

In the ERS configuration I can’t see how to do this, as the commands above do not translate equally to BOSS?

The configuration I have so far is

For MD5/DES:

snmp-server user engine-id 0x80:00:1f:88:80:d5:74:92:2d:32:d4:4a:5d snmpuser md5 des

For SHA/AES

snmp-server user snmpuser sha aes

The engine ID has been taken from XMC via:

/usr/local/Extreme_Networks/NetSight/services/snmptrapd.conf

In addition, do you know what configuration is required in XMC. Running version 8.3 but I am falling back to the java version and adding the engine ID for the switch into the snmptrapd file.

For MD5/DES I’m thinking it will look something like the below, with the engineID being that of the switch:

createUser -e 0x800002328002005d31384f4c3531303045333030 snmpuser MD5 snmpauthcred DES snmpprivcred

For SHA/AES thinking I just need to add:

# createUser myAuthPrivUser SHA mypassword AES myotherpassword

Maybe I don’t need to go to all this trouble at all and like EXOS its done automatically?

Many thanks in advance

Re: VSP - unable send traps to XMC SNMPv3

Anonymous — Thu, 21 Nov 2019 00:42:35 GMT

These commands worked for me. Yet to configure traps, but will post when working

snmp-server view root +1
snmp-server user netsight sha aes read-view root write-view root notify-view root

Re: VSP - unable send traps to XMC SNMPv3

csantos — Thu, 20 Aug 2020 21:35:16 GMT

Hi Zdenek,

I’m having the exact same issue and I’ve tried your way, commands by that order. The VSP still does not send Traps to the XMC.

This is my config.

When I disable a link on a device connected to this VSP, I’m still not able to see any traffic coming on XMC (port 162), using the tcpdump command.

Also, you can see that I’ve enabled the Link-status trap.

So, any ideas on this?

Regards,

César Santos

Re: VSP - unable send traps to XMC SNMPv3

PeterK — Sat, 22 Aug 2020 16:28:32 GMT

Hi Cesar,

I’m currently not 100% sure, but It looks like you have configured to send informs and not traps.

I personally use traps, because I never got informs running with netsight.

Re: VSP - unable send traps to XMC SNMPv3

csantos — Mon, 24 Aug 2020 15:30:27 GMT

Hi Peter,

Actually I’ve already tried with snmp traps. The problem remains.

The use of informs is what we get when on XMC we select the “Register Trap Receiver”. Basically, the XMC sets the configuration of the snmp-server and it uses informs instead of traps.

The most annoying thing is that on XMC I cannot see any incoming traffic on port 162 from my VSPs. I see from my EXOS stacks, but not from my VSPs. So, I think is clearly something related with the VOSS configuration or the software version.

Re: VSP - unable send traps to XMC SNMPv3

csantos — Thu, 27 Aug 2020 14:56:23 GMT

Hi,

About this, I’ve reach out the support team and now the SNMP traps on my VSPs devices are working fine.

So, first, I’ve configured a loopback IP address (CLIP) on the switch to use it as the SNMP sender source. On the VOSS CLI reference doc (https://documentation.extremenetworks.com/VOSS/SW/71x/9035528_CLIRefVOSS_7.1_CRG.pdf), page 2110, it says that the IP SNMP sender source should be a CLIP address. If is not a CLIP address, then the config snmp-server force-trap-sender enable will be ignored and the switch automatically uses the IP address of the logical interface that is closest (from the perspective of the routing table). If the reachability to the SNMP server is over an IS-IS/SPB IP shortcut NNI, the switch automatically uses the IS-IS IP source address and the settings from this command are ignored.

After this, I was able to use the command snmp-sever force-trap-sender enable properly. So, my snmp config, look like this:

------------------------------------------

snmp-server contact "Contact"

snmp-server location "Location"

snmp-server authentication-trap enable

snmp-server force-iphdr-sender enable

snmp-server sender-ip <XMC Server IP> <CLIP address of the switch>

snmp-server force-trap-sender enable

snmp-server user user_xmc group "xmcgroup"

snmp-server view "xmc_read" 1

snmp-server view "xmc_write" 1

snmp-server view "xmc_notify" 1

snmp-server group "xmcgroup" "" auth-priv read-view xmc_read write-view xmc_write notify-view root

snmp-server group "user_xmc" "" auth-priv read-view xmc_read write-view xmc_write notify-view xmc_notify

snmp-server host <XMC server IP> v3 authPriv user_xmc inform

------------------------------------------

After this config, I was able to see traffic on the tcpdump capture coming through port 162 (SNMP traps) to the XMC from the VSP.

At last I removed the VSP switches from XMC and added them again using the CLIP address.

I hope this helps someone else.

Regards