Disabling SNMP v1

[DCIM_Support]

Hi,

I need to disable SNMP v1 and have the environment using v3. 

Does anyone know the best way to configure this? I know I will need to do a mass config for all devices in DCE to use SNMP v3 instead of v1. 

Martin

(CID:108825659)

[DCIM_Support · Accepted solution]

Hi Martin,

I suggest checking out the following k-base document:

Monitoring an APC device with StruxureWare Central using SNMP version 3 after it was discovered using SNMP version 1.

http://www.apc.com/us/en/faqs/index?page=content&id=FA158442

I suggest testing with just a few at first, just in case.

Steve

(CID:108825684)

[DCIM_Support]

excellent thank you, I will check this out and test on a couple of devices first 🙂

(CID:108825691)

[DCIM_Support]

Hi Steve, I have followed the instructions on the link above, however when I apply the change it doesn't complete and I get the following. Martin

Error.JPG

(CID:108826673)

[DCIM_Support]

Hi Martin, It sounds like the value DCE is trying to pass to the device may not be something the device itself supports. The first thing I would try is to put that same authentication phrase directly on the device to see if the device accepts it. You should also note (and I think you may get a different message) that to validate strings such as passwords and authentication phrases (when the config.ini is used) DCE will attempt to pull the config.ini back again and verify what it sent to what it pulld back. These passwords and auth phrases are no longer contained in the config.ini when pulled back from the device for security reasons. This should be easy enough to verify if you check the NMC itself. Please also make sure your auth phrase matches the size stated in the manual...this is from the 6.4 firmware manual on a UPS: Authentication Passphrase: A phrase of 15 to 32 ASCII characters (apc auth passphrase, by default) that verifies that the NMS communicating with this device through SNMPv3 is the NMS it claims to be. Also, please be sure you're using the correct option when configuring APC devices. There is an option in the newer releases of DCE to configure NMC running version 6 or higher. Older DCE servers could not configure some specific settings on version 6 firmware. What version of DCE are you running? Steve

(CID:108826677)

[DCIM_Support]

Hi Steve, I am trying to configure the Rack Mount PDUs AP8853 - I have checked on the DCE server and it appears that the SNMP Agent is disabled. I have gone to the remote web admin page for the DCO server and can see in there that SNMP v1 and v3 are enabled. Its from here that i am getting the SNMP v3 Username Password (I guess this is my Authentication Phase?) I have used this directly on to the PDU I am testing and it appears to have accepted what i have put in, I didn't see any errors. I am running DCE version 7.3.1 Many thanks Martin

(CID:108826678)

[DCIM_Support]

Hi Martin, The SNMP agent on DCE is for polling the DCE itself and has nothing to do with polling devices. Likewise, if you've configured SNMP on DCO, that's just so DCE or another SNMP monitoring system can monitor it, it doesn't monitor devices. You did say thanks though so can I assume adding the strings manually into the NMC resolved your issue? The Auth phrase I mentioned is one of the SNMP version 3 options in the card when configuring the user profile. The options you have are user name, Authentication Passphrase (when using MD5 or SHA), and Privacy Passphrase (when configuring AES or DES). Steve

(CID:108826684)

[DCIM_Support]

Hi Steve, When I login to the Admin web console for the DCO server, and untick SNMP v1 this looses its connection to DCE. How do i configure DCE to communicate with DCO using SNMP v3? Do I need to have SNMP enabled on the PDUs? Martin

DCE Lost Connection error.JPG

(CID:108826804)

[DCIM_Support]

Martin, You will need to configure SNMPv1 within Data Center Operations Webmin page. You will then need to delete the DCO server from Data Center Expert and then rediscover it using SNMPv3. There is no way to change the communication to SNMPv3 for DCE polling DCO information without the deletion and rediscovery. Regards, Cory

(CID:108827572)

[DCIM_Support]

Hello Cory, Thank you for the comment, I have done what you suggested, I unticked v1 rebooted the server then removed it from DCO, however when running the discovery for SNMP v3 the discovery doesn't run it stays on "Idle". I re enabled v1, ran the discovery again for SNMP v1 and its added back in fine. How do I check to make sure the v3 is enabled in DCE? Martin

(CID:108827722)

[DCIM_Support]

Martin, To enabled SNMPv3 on DCO: 1) Open Webmin. HTTPS://DCOIP:10000 2) StruxureWare DC Operation Menu > Setup. 3) Enabled v3 and set the SNMPv3 Username/Password. 4) Select the Setup Button, which will stop the DCO server and make the changes. To discover DCO now within DCE: 1) Ensure that the DCO server is deleted from DCE. 2) Device > Add Devices. 3) Select SNMPv3 > Next. 4) Type in the username you defined above. 5) Set Authentication Type to SHA and Encryption type to AES-128 and fill in the password you defined above for both. 6) Select Next. 7) Select a device group > Next. 😎 Check the box for Run Discovery Now > Finish. Regards, Cory

(CID:108827976)

[DCIM_Support]

Hi Cory Thank you for the info above, I have now been able to add the DCO server using SMNPv3. Martin

(CID:108828058)

[DCIM_Support]

Martin, You're welcome. Regards, Cory

(CID:108828072)

[DCIM_Support]

Now I need to disable SNMPv1 - Do I need to delete the device and rediscover it? I have followed the initial link above, however as soon as SNMPv1 is disabled (after configuring v3) DCE looses communication.

(CID:108828073)

[DCIM_Support]

This question is closed for comments. You're welcome to start a new topic if you have further comments on this issue.