WEBVTT

1
00:00.000 --> 00:06.370
Well, when we talked about how SNMP version 3 is a little bit complex, a lot of

2
00:06.370 --> 00:06.880
this has

3
00:06.880 --> 00:10.980
to do with the iOS XC CLI configuration.

4
00:10.980 --> 00:14.360
This requires a little bit of practice because we might say, "Okay, it's super

5
00:14.360 --> 00:15.360
straightforward.

6
00:15.360 --> 00:17.800
I set it up with a username and password."

7
00:17.800 --> 00:20.040
But unfortunately, it's not that simple.

8
00:20.040 --> 00:21.880
Now, we'll see this.

9
00:21.880 --> 00:25.920
NXOS, Cisco's Nexus platform, does this very, very well.

10
00:25.920 --> 00:34.130
It's way easier to set up SNMP via NXOS, whereas CLI on the iOS XC takes a
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:25.920 --> 00:34.130
It's way easier to set up SNMP via NXOS, whereas CLI on the iOS XC takes a

11
00:34.130 --> 00:35.520
little bit

12
00:35.520 --> 00:37.800
of overcoming frustration.

13
00:37.800 --> 00:40.820
But that aside, let's just make sure that we understand how it works and that

14
00:40.820 --> 00:41.240
we don't

15
00:41.240 --> 00:43.160
need to worry about it anymore.

16
00:43.160 --> 00:47.000
So the iOS XC architecture comes down to three concepts.

17
00:47.000 --> 00:54.480
We have Views, Groups, and Users.

18
00:54.480 --> 01:01.960
Now again, a user is going to be a true username and password combination.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

18
00:54.480 --> 01:01.960
Now again, a user is going to be a true username and password combination.

19
01:01.960 --> 01:03.720
And maybe that's on a radius server.

20
01:03.720 --> 01:05.760
Maybe it's locally configured on the device.

21
01:05.760 --> 01:09.640
But either way, I'm going to create a username and password.

22
01:09.640 --> 01:16.400
And I'm going to set the security level for that particular username.

23
01:16.400 --> 01:18.920
And so that's pretty simple.

24
01:18.920 --> 01:20.760
So what about Views and Groups?

25
01:20.760 --> 01:26.280
Well, Cisco's attempt to make this a little bit more of a modular configuration

26
01:26.280 --> 01:26.960
style,

27
01:26.960 --> 01:28.560
which is the trend with CLI.

28
01:28.560 --> 01:33.180
We want to make things as modular as possible so I can apply different Views
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
01:28.560 --> 01:33.180
We want to make things as modular as possible so I can apply different Views

29
01:33.180 --> 01:34.080
and Groups to

30
01:34.080 --> 01:38.770
Users and have the different combinations in here so that whatever my needs are

31
01:38.770 --> 01:39.360
, I can

32
01:39.360 --> 01:43.850
very simply do that without having to reinvent the wheel, so to speak, and

33
01:43.850 --> 01:44.840
configure things

34
01:44.840 --> 01:47.560
fresh from the ground up every single time.

35
01:47.560 --> 01:52.910
So when we start with Views, a View defines what aspects of a device that a

36
01:52.910 --> 01:53.880
particular

37
01:53.880 --> 01:56.920
SNMP manager and NMS can see.

38
01:56.920 --> 02:02.240
So this is basically giving us our authorization concept.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:56.920 --> 02:02.240
So this is basically giving us our authorization concept.

39
02:02.240 --> 02:06.350
It's letting us know what I can do on the device and what I can't do on the

40
02:06.350 --> 02:07.120
device.

41
02:07.120 --> 02:12.310
So in a lot of cases, we'll set this to say, hey, you can just have full access

42
02:12.310 --> 02:13.560
to the device,

43
02:13.560 --> 02:16.800
but maybe I want you to have partial access to the device.

44
02:16.800 --> 02:20.480
Maybe I want you to see my Layer 2 configuration, but not my Layer 3

45
02:20.480 --> 02:22.080
configurations and setting

46
02:22.080 --> 02:26.690
up partial as we might imagine is going to require some SNMP knowledge around

47
02:26.690 --> 02:27.240
the MIB

48
02:27.240 --> 02:29.080
and the OIDs.

49
02:29.080 --> 02:34.530
Now Groups, when we are looking at Groups, we're actually going to use this as
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

49
02:29.080 --> 02:34.530
Now Groups, when we are looking at Groups, we're actually going to use this as

50
02:34.530 --> 02:35.080
sort of

51
02:35.080 --> 02:38.600
the way to glue our users to our Views.

52
02:38.600 --> 02:43.920
So the Group is going to be created in Read or Write fashion.

53
02:43.920 --> 02:47.600
So this is where we define that aspect of SNMP.

54
02:47.600 --> 02:55.320
And then I also define the security that's going to be used.

55
02:55.320 --> 02:57.760
Specifically I have three options.

56
02:57.760 --> 03:03.680
I have no auth and no priv, all one word like this.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

56
02:57.760 --> 03:03.680
I have no auth and no priv, all one word like this.

57
03:03.680 --> 03:08.610
And as we can tell, we're saying no authentication, no privacy, meaning no

58
03:08.610 --> 03:09.680
encryption.

59
03:09.680 --> 03:11.800
So this is basically saying no security.

60
03:11.800 --> 03:15.710
We definitely don't want to use this, otherwise we might as well be using

61
03:15.710 --> 03:16.680
version 2C.

62
03:16.680 --> 03:21.240
Or we can set up auth no priv.

63
03:21.240 --> 03:24.200
Okay, so that's giving us authentication.

64
03:24.200 --> 03:27.820
So that's a start, but maybe we don't want to encrypt our traffic for one

65
03:27.820 --> 03:29.040
reason or another.

66
03:29.040 --> 03:30.800
So that is certainly an option.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
03:29.040 --> 03:30.800
So that is certainly an option.

67
03:30.800 --> 03:34.870
The most secure option is going to be auth priv, and that is giving us

68
03:34.870 --> 03:36.280
authentication,

69
03:36.280 --> 03:39.200
and it's giving us encryption.

70
03:39.200 --> 03:43.710
So when we say the users are getting their security level set up, we might have

71
03:43.710 --> 03:44.160
to, for

72
03:44.160 --> 03:50.520
example, make sure that we have the appropriate password and encryption level

73
03:50.520 --> 03:51.440
in here.

74
03:51.440 --> 03:53.680
So this is how the configuration comes together.

75
03:53.680 --> 03:57.030
It's not that bad, but we can already see it's way more complex than version 2C

76
03:57.030 --> 03:57.240
, which

77
03:57.240 --> 04:02.220
simply requires setting a community string along with Read and Write
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
03:57.240 --> 04:02.220
simply requires setting a community string along with Read and Write

78
04:02.220 --> 04:04.000
operational levels.

79
04:04.000 --> 04:07.890
So let's go ahead and flip over to our CLI and just do a quick configuration

80
04:07.890 --> 04:08.160
just to

81
04:08.160 --> 04:09.760
kind of show how this comes together.

82
04:09.760 --> 04:16.140
So I'm going to do a config T on my router here, and I'm going to say SNMP

83
04:16.140 --> 04:16.920
server and

84
04:16.920 --> 04:17.920
create a view.

85
04:17.920 --> 04:20.560
I'll just call this CBT view.

86
04:20.560 --> 04:24.400
And then I can enable full access with ISO included.

87
04:24.400 --> 04:28.670
So this is basically creating that view that allows for full access to the

88
04:28.670 --> 04:29.360
device.

89
04:29.360 --> 04:31.480
So that was the left side of our chalkboard.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

89
04:29.360 --> 04:31.480
So that was the left side of our chalkboard.

90
04:31.480 --> 04:32.760
I have already created my view.

91
04:32.760 --> 04:34.240
Now that's not too bad.

92
04:34.240 --> 04:35.480
Now let's create my group.

93
04:35.480 --> 04:38.000
SNMP server group.

94
04:38.000 --> 04:40.720
And then I'm going to say CBT group.

95
04:40.720 --> 04:43.720
And I'm going to specify this is for version three.

96
04:43.720 --> 04:47.350
And then now I can specify that auth or that no auth or that priv level or

97
04:47.350 --> 04:48.120
whatever it

98
04:48.120 --> 04:49.120
is I want to do.

99
04:49.120 --> 04:53.200
So I'm going to say priv here, then I can specify whether I want read or write.

100
04:53.200 --> 04:55.520
I'll just call this read for read only.

101
04:55.520 --> 04:57.520
And I map it to my view here.

102
04:57.520 --> 05:00.000
So I can say CBT view.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

102
04:57.520 --> 05:00.000
So I can say CBT view.

103
05:00.000 --> 05:02.680
All right, I already created my group.

104
05:02.680 --> 05:03.680
No problem.

105
05:03.680 --> 05:04.720
Well now I have to create my user.

106
05:04.720 --> 05:08.160
So SNMP server user.

107
05:08.160 --> 05:12.160
And let's go ahead and create a user name of, I'll just call it user.

108
05:12.160 --> 05:13.160
Why not?

109
05:13.160 --> 05:16.120
Capital USER for user.

110
05:16.120 --> 05:18.480
And then I want to place it into a group.

111
05:18.480 --> 05:20.040
So which group it belongs in.

112
05:20.040 --> 05:23.200
So CBT group is the group name.

113
05:23.200 --> 05:25.000
And then I've got to specify my parameter.

114
05:25.000 --> 05:27.960
So I'm going to use the version three security model for this user.

115
05:27.960 --> 05:30.800
I'm going to specify my authentication.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

115
05:27.960 --> 05:30.800
I'm going to specify my authentication.

116
05:30.800 --> 05:33.200
Now I can decide again, this is where it's interesting.

117
05:33.200 --> 05:36.640
I can set my security settings so I can go with MD5.

118
05:36.640 --> 05:38.160
Usually we go with Shaw here.

119
05:38.160 --> 05:39.920
So you're going to go with Shaw.

120
05:39.920 --> 05:45.060
And then I specify my password of pass whatever our user name and password is

121
05:45.060 --> 05:46.240
going to be.

122
05:46.240 --> 05:47.560
And then again, I keep going.

123
05:47.560 --> 05:50.480
So I just specified my authentication parameters.

124
05:50.480 --> 05:55.440
But I need to now specify my priv or my encryption parameters as well.

125
05:55.440 --> 05:58.480
So I can decide which version of encryption I want to use.

126
05:58.480 --> 06:03.440
Should never use desert triple this in modern networks, so we'll specify AES.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

126
05:58.480 --> 06:03.440
Should never use desert triple this in modern networks, so we'll specify AES.

127
06:03.440 --> 06:07.520
You can specify the level of AES, AES 256.

128
06:07.520 --> 06:09.760
And then the privacy password here.

129
06:09.760 --> 06:12.160
So I can enter a secret.

130
06:12.160 --> 06:16.000
And then we've got the ability to also use an access control list if we so

131
06:16.000 --> 06:16.920
desire.

132
06:16.920 --> 06:18.720
So I can specify my user.

133
06:18.720 --> 06:23.520
And that is how we go about creating the SNMP version three configuration on an

134
06:23.520 --> 06:24.640
iOS XE device.