Lab Objective:
The focus of this lab is to understand Simple Network Management Protocol implementation and configuration in Cisco IOS routers. Additional technologies include security.
Lab Topology:
This lab requires only a single router running, at a minimum, Cisco IOS Software 12.4 Mainline. The router should have at least one Ethernet interface. The primary purpose of this lab is to reinforce configuration knowledge of the stated chapter.
|
IMPORTANT NOTE If you have multiple devices and servers / hosts in your home lab and you would like to test solutions for topics such as Syslog, SNMP and NetFlow by setting up host and viewing charts or logging information, for example, please feel free to do so. While these labs include logging to ‘supposed’ hosts, there are no SNMP or Syslog servers in the http://www.howtonetwork.net racks and so you will not be able to test the solutions in those racks. If you only have a single router, you can bring up the Ethernet interface by implementing the following configuration: ! |
Task 1
Configure two SNMP communities on the device: one RO community named STANDARD and one RW community named ADVANCED. The RO community should be accessible only by NMSs 150.2.2.253 and 150.2.2.254. The RW community should be accessible only by NMSs 150.3.3.253 and 150.3.3.254. Verify your SNMP configuration using the appropriate commands.
Task 2
Management recently purchased a CiscoWorks LMS solution. They would to use RME for device configuration file and software image management. This will be performed via the Trivial File Transfer Protocol (TFTP). Configure the device so that only host 150.1.1.254 is allowed TFTP access to perform these actions.
Task 3
Management has requested that, for easier identification, SNMP traps and informs be sent from the device using a source IP address of 1.1.1.1. In addition to this, Management has also requested that CiscoWorks be allowed to initiate a remote reload (reboot) of this device. This is important as this tool will be used for software upgrades in the future. Configure the device as requested. Verify your configuration using the appropriate commands.
Task 4
Configure the router to send SNMPv2 traps to hosts 150.2.2.253 and 150.2.2.254. These should be sent with the community string STANDARD. Verify your configuration using the appropriate commands. The device should only send environmental monitor traps to host 150.2.2.253 and Syslog traps to host 150.2.2.254. Verify your SNMP configuration using the appropriate commands.
Task 5
Configure the router to send SNMPv2 informs to hosts 150.3.3.253 and 150.3.3.254. These should be sent with the community string ADVANCED. To ensure that informs are received, the router should be configured to resend an inform at least 10 time while waiting at least 60 seconds between retries. And finally, to prevent the premature discarding of pending informs due to a lack of acknowledgement, configure the router to store up to 50 unacknowledged informs. Verify your configuration using the appropriate commands.
Lab Validation
Task 1
This task is straightforward and requires ACLs with SNMP. This is completed as follows:
| R1(config)#access-list 1 permit host 150.2.2.253 R1(config)#access-list 1 permit host 150.2.2.254 R1(config)#access-list 2 permit host 150.3.3.253 R1(config)#access-list 2 permit host 150.3.3.254 R1(config)#snmp-server community STANDARD RO 1 R1(config)#snmp-server community ADVANCED RW 2 |
Verify your configuration using the show snmp community command on the router:
| R1#show snmp community
Community name: ILMI
Community name: STANDARD
Community name: ADVANCED |
Task 2
The CiscoWorks LAN Management Solution (LMS) is comprised of several individual software applications that can be used for the configuration and administration of campus networks. LMS also provides monitoring, and troubleshooting capabilities. The following applications are included in the CiscoWorks LAN Management Solution suite:
- Resource Manager Essentials (RME)
- CiscoWorks Health and Utilization Monitor
- Device Fault Manager (DFM)
- Internetwork Performance Monitor (IPM)
Resource Manager can also be used for network monitoring and fault information for tracking devices that are critical to network uptime. RME can also be used for device configuration and software image management via TFTP. This task is completed in one of two ways. The legacy methods of implementing this configuration is shown below:
| R1(config)#access-list 3 permit host 150.3.3.254 R1(config)#snmp-server tftp-server-list 3 R1(config)#exit |
In current versions of software, this task would be completed as follows:
| R1(config)#access-list 3 permit host 150.3.3.254 R1(config)#snmp-server file-transfer access-group 3 protocol tftp R1(config)#exit |
While there is no explicit command to view the configured parameters, you can always view the device configuration file to verify your configuration:
| R1#more system:running-config | section snmp snmp-server community STANDARD RO 1 snmp-server community ADVANCED RW 2 snmp-server file-transfer access-group 3 protocol tftp |
Task 3
In order to specify a source IP address, you must configure an interface with this IP address and then specify that as the SNMP source interface. To complete the second requirement, you need to use the system-shutdown SNMP command. This command allows a certain SNMP set operation to trigger a router reboot and can be used by CiscoWorks LMS Resource Manager Essentials (RME). This task is completed as follows:
| R1(config)#interface loopback 0 R1(config-if)#ip address 1.1.1.1 255.255.255.255 R1(config-if)#exit R1(config)#snmp-server trap-source loopback 0 R1(config)#snmp-server source-interface informs loopback 0 R1(config)#snmp-server system-shutdown R1(config)#exit |
Again, view the device configuration to verify your solution:
| R1#more system:running-config | section snmp snmp-server community STANDARD RO 1 snmp-server community ADVANCED RW 2 snmp-server trap-source Loopback0 snmp-server source-interface informs Loopback0 snmp-server system-shutdown snmp-server file-transfer access-group 3 protocol tftp |
Task 4
The requirements of this task are straightforward and are completed as follows:
| R1(config)#snmp-server host 150.2.2.253 traps version 2c STANDARD envmon R1(config)#snmp-server host 150.2.2.254 traps version 2c STANDARD syslog R1(config)#snmp-server enable traps envmon R1(config)#snmp-server enable traps syslog |
Next, verify your configuration using the show snmp host command:
| R1#show snmp host
Notification host: 150.2.2.253 udp-port: 162 type: trap Notification host: 150.2.2.254 udp-port: 162 type: trap |
Task 5
The requirements of this task are straightforward. To configure SNMP inform parameters, we need to use the snmp-server inform command. This task is completed as follows:
| R1(config)#snmp-server host 150.3.3.253 informs version 2c ADVANCED R1(config)#snmp-server host 150.3.3.254 informs version 2c ADVANCED R1(config)#snmp-server inform retries 10 R1(config)#snmp-server inform timeout 60 R1(config)#snmp-server inform pending 50 |
Following this, verify your configuration using the show snmp command:
| R1#show snmp Chassis: JAE08020Z7T 0 SNMP packets input 0 Bad SNMP version errors 0 Unknown community name 0 Illegal operation for community name supplied 0 Encoding errors 0 Number of requested variables 0 Number of altered variables 0 Get-request PDUs 0 Get-next PDUs 0 Set-request PDUs 0 Input queue packet drops (Maximum queue size 1000) 0 SNMP packets output 0 Too big errors (Maximum packet size 1500) 0 No such name errors 0 Bad values errors 0 General errors 0 Response PDUs 0 Trap PDUs SNMP logging: enabled SNMP Manager-role output packets SNMP informs: enabled |
You can also use the show snmp host command for verification:
| R1#show snmp host
Notification host: 150.3.3.253 udp-port: 162 type: inform Notification host: 150.3.3.254 udp-port: 162 type: inform Notification host: 150.2.2.253 udp-port: 162 type: trap Notification host: 150.2.2.254 udp-port: 162 type: trap |
Finally, you can also verify your configuration by looking at the device configuration file:
| R1#show running-config | section include inform snmp-server source-interface informs Loopback0 snmp-server host 150.3.3.253 inform version 2c ADVANCED snmp-server host 150.3.3.254 inform version 2c ADVANCED snmp-server inform retries 10 timeout 60 pending 50 |
Final Router Configurations
R1
|
R1#term len 0 Current configuration : 1563 bytes R1# |