4.8. SNMP Command Reference
4.8.1. Command Hierarchies
4.8.1.1. Configuration Commands
4.8.1.1.1. SNMP System Commands
4.8.1.1.2. SNMP Security Commands
The following commands configure user-specific SNMP features. Refer to the Security Command Reference section for CLI syntax and command descriptions.
4.8.1.2. Show Commands
4.8.2. Command Descriptions
4.8.2.1. Configuration Commands
4.8.2.1.1. SNMP System Commands
snmp
Syntax
Context
Description
This command enables the context to configure SNMP parameters.
engineID
Syntax
Context
Description
This command sets the SNMP engine ID to uniquely identify the SNMPv3 node. By default, the engine ID is generated using information from the system backplane.
If the SNMP engine ID is changed in the config>system>snmp>engineID engine-id context, the current configuration must be saved and a reboot must be executed. If the configuration is not saved and the system is not rebooted, the previously configured SNMP communities and logger trap-destination notify communities will not be valid for the new engine ID.
 | Caution: In conformance with IETF standard RFC 3414, User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3), hashing algorithms that generate SNMPv3 MD5 or SHA security digest keys use the engine ID. Changing the SNMP engine ID invalidates all SNMPv3 MD5 and SHA security digest keys and may render the node unmanageable. If the SNMP engine ID is changed, the SNMP hash keys must be reconfigured. |
This command could be used, for example, when a chassis is replaced. Use the engine ID of the first system and configure it in the new system to preserve SNMPv3 security keys. This allows management stations to use their existing authentication keys for the new system.
Ensure that the engine IDs are not used on multiple systems. A management domain can only have one instance of each engine ID.
The no form of the command reverts to the default setting.
Default
the engine ID is system-generated
Parameters
general-port
Syntax
Context
Description
This command configures the port number used by this node to receive SNMP request messages and to send replies. SNMP notifications generated by the agent are sent from the port specified in the config>log>snmp-trap-group>trap-target command.
The no form of the command reverts to the default value.
Default
161
Parameters
packet-size
Syntax
Context
Description
This command configures the maximum SNMP packet size generated by this node. If the packet size exceeds the MTU size of the egress interface, the packet will be fragmented.
The no form of the command reverts to the default value.
Default
1500 bytes
Parameters
shutdown
Syntax
Context
Description
This command administratively disables SNMP agent operations. System management can then only be performed using the CLI. Shutting down SNMP does not remove or change configuration parameters other than the administrative state. This command does not prevent the agent from sending SNMP notifications to any configured SNMP trap destinations. SNMP trap destinations are configured under the config>log>snmp-trap-group context.
This command is automatically invoked in the event of a reboot when the processing of the configuration file fails to complete or when an SNMP persistent index file fails while the bof persist on command is enabled.
The no form of the command administratively enables SNMP.
Default
no shutdown
4.8.2.1.2. SNMP Security Commands
snmp
Syntax
Context
Description
This command enables the context to configure SNMPv1, SNMPv2c, and SNMPv3 parameters
access group
Syntax
Context
Description
This command creates an association between a user group, a security model, and the views that the user group can access. Access parameters must be configured unless security is limited to the preconfigured access groups and views for SNMPv1 and SNMPv2c. An access group is defined by a unique combination of the group name, security model, and security level.
Access must be configured unless security is limited to SNMPv1/SNMPv2c with community strings (see community).
Default access group configurations cannot be modified or deleted.
To remove the user group with associated security models and security levels, use the command no access group group-name.
To remove a security model and security level combination from a group, use the command no access group group-name security-model {snmpv1 | snmpv2c | usm} security-level {no-auth-no-privacy | auth-no-privacy | privacy}.
Default
n/a
Parameters
attempts
Syntax
Context
Description
This command configures a threshold value for the number of unsuccessful SNMP connection attempts allowed in a specified time frame. The command parameters are used to counter denial of service (DOS) attacks through SNMP.
If the threshold is exceeded, the host is locked out for the lockout time period.
If multiple attempts commands are entered, each command overwrites the previously entered command.
The no form of the command resets the parameters to the default values.
Default
attempts 20 time 5 lockout 10
Parameters
community
Syntax
Context
Description
This command creates SNMP community strings for SNMPv1 and SNMPv2c access. This command is used in combination with the predefined access groups and views. To create custom access groups and views and associate them with SNMPv1 or SNMPv2c access, use the usm-community command.
When configured, community implies a security model for SNMPv1 and SNMPv2c only.
For SNMPv3 security, the snmp command must be configured.
The no form of the command removes a community string.
Default
n/a
Parameters
- r — grants only read access to objects in the MIB, except security objects
- rw — grants read and write access to all objects in the MIB, except security objects
- rwa — grants read and write access to all objects in the MIB, including security objects
- mgmt — assigns a unique SNMP community string to the management router
- vpls-mgmt — assigns a unique SNMP community string to the management virtual router
usm-community
Syntax
Context
Description
This command is used to associate a community string with an SNMPv3 access group and its view. The access granted with a community string is restricted to the scope of the configured group.
The 7705 SAR implementation of SNMP uses SNMPv3. In order to implement SNMPv1 and SNMPv2c configurations, several access groups are predefined. In order to implement SNMP with security features (version 3), security models, security levels, and USM communities must be explicitly configured. Optionally, additional views that specify more specific OIDs (MIB objects in the subtree) can be configured.
The no form of this command removes a community string.
Default
n/a
Parameters
view
Syntax
Context
Description
This command configures a view. Views control the accessibility of a MIB object within the configured MIB view and subtree. Object identifiers (OIDs) uniquely identify MIB objects in the subtree. OIDs are organized hierarchically with specific values assigned by different organizations.
Once the subtree (OID) is identified, a mask can be created to select the portions of the subtree to be included or excluded for access using this particular view. See the mask command. The views configured with this command can subsequently be used in read, write, and notify commands that are used to assign specific access group permissions to created views and assigned to particular access groups.
Multiple subtrees can be added or removed from a view name to tailor a view to the requirements of the user access group.
The no view view-name command removes a view and all subtrees.
The no view view-name subtree oid-value command removes a sub-tree from the view name.
Default
no views are defined
Parameters
It is possible to have a view with different subtrees with their own masks and include and exclude statements. This allows you to customize visibility and write capabilities for specific user requirements
mask
Syntax
Context
Description
The mask value and the mask type, along with the oid-value configured in the view command, determines the access of each sub-identifier of an object identifier (MIB subtree) in the view.
Each bit in the mask corresponds to a sub-identifier position; for example, the most significant bit for the first sub-identifier, the next most significant bit for the second sub-identifier, and so on. If the bit position on the sub-identifier is available, it can be included or excluded.
For example, the MIB subtree that represents MIB-II is 1.3.6.1.2.1. The mask that catches all MIB-II is 0xfc or 0b11111100.
Only a single mask may be configured per view and OID value combination. If more than one entry is configured, each subsequent entry overwrites the previous entry.
Per RFC 2575, View-based Access Control Model (VACM) for the Simple Network Management Protocol (SNMP), each MIB view is defined by two sets of view subtrees, the included view subtrees, and the excluded view subtrees. Every view subtree, both the included and the excluded ones, are defined in this table. To determine if a particular object instance is in a particular MIB view, compare the object instance’s object identifier (OID) with each of the MIB view’s active entries in this table. If none match, then the object instance is not in the MIB view. If one or more match, then the object instance is included in, or excluded from, the MIB view according to the value of vacmViewTreeFamilyType in the entry whose value of vacmViewTreeFamilySubtree has the most sub-identifiers.
The no form of this command removes the mask from the configuration.
Default
no mask
Parameters
The mask can be entered in either:
- hexadecimal format (for example, 0xfc)
- binary format (for example, 0b11111100)
Note: If the number of bits in the bit mask is less than the number of sub-identifiers in the MIB subtree, then the mask is extended with ones until the mask length matches the number of sub-identifiers in the MIB subtree.
included - all MIB subtree objects that are identified with a 1 in the mask are available in the view
excluded - all MIB subtree objects that are identified with a 1 in the mask are denied access in the view
4.8.2.2. Show Commands
| Note: The following command outputs are examples only; actual displays may differ depending on supported functionality and user configuration. |
counters
Syntax
Context
Description
This command displays SNMP counter information. SNMP counters will continue to increase even when SNMP is shut down. Some internal modules communicate using SNMP packets.
Output
The following output is an example of SNMP counters information, and Table 23 describes the fields.
Table 23: Show SNMP Counters Output Fields
Label | Description |
in packets | The total number of messages delivered to SNMP from the transport service |
in gets | The number of SNMP get request PDUs accepted and processed by SNMP |
in getnexts | The number of SNMP get next PDUs accepted and processed by SNMP |
in sets | The number of SNMP set request PDUs accepted and processed by SNMP |
out packets | The total number of SNMP messages passed from SNMP to the transport service |
out get responses | The number of SNMP get response PDUs generated by SNMP |
out traps | The number of SNMP Trap PDUs generated by SNMP |
variables requested | The number of MIB objects requested by SNMP |
variables set | The number of MIB objects set by SNMP as the result of receiving valid SNMP set request PDUs |
information
Syntax
Context
Description
This command lists the SNMP configuration and statistics.
Output
The following output is an example of system information, and Table 24 describes the fields.
Table 24: Show System Information Output Fields
Label | Description |
System Name | The name configured for the device |
System Contact | The text string that identifies the contact name for the device |
System Location | The text string that identifies the location of the device |
System Coordinates | The text string that identifies the system coordinates for the device location. For example, “37.390 -122.0550" is read as latitude 37.390 north and longitude 122.0550 west. |
System Up Time | The time since the last reboot |
SNMP Port | The port that SNMP sends responses to management requests |
SNMP Engine ID | The ID for either the local or remote SNMP engine to uniquely identify the SNMPv3 node |
SNMP Max Message Size | The maximum size SNMP packet generated by this node |
SNMP Admin State | Enabled: SNMP is administratively enabled |
Disabled: SNMP is administratively disabled | |
SNMP Oper State | Enabled: SNMP is operationally enabled |
Disabled: SNMP is operationally disabled | |
SNMP Index Boot Status | Persistent: Persistent indexes was enabled at the last system reboot |
Disabled: Persistent indexes was disabled at the last system reboot | |
SNMP Sync State | The state when the synchronization of configuration files between the primary and secondary CSMs finish |
Tel/Tel6/SSH/FTP Admin | The administrative state of the Telnet, Telnet IPv6, SSH, and FTP sessions |
Tel/Tel6/SSH/FTP Oper | The operational state of the Telnet, Telnet IPv6, SSH, and FTP sessions |
BOF Source | The boot location of the BOF |
Image Source | primary: specifies whether the image was loaded from the primary location specified in the BOF |
secondary: specifies whether the image was loaded from the secondary location specified in the BOF | |
tertiary: specifies whether the image was loaded from the tertiary location specified in the BOF | |
Config Source | primary: specifies whether the configuration was loaded from the primary location specified in the BOF |
secondary: specifies whether the configuration was loaded from the secondary location specified in the BOF | |
tertiary: specifies whether the configuration was loaded from the tertiary location specified in the BOF | |
Last Booted Config File | The URL and filename of the configuration file used for the most recent boot |
Last Boot Cfg Version | The version of the configuration file used for the most recent boot |
Last Boot Config Header | The header information of the configuration file used for the most recent boot |
Last Boot Index Version | The index version used in the most recent boot |
Last Boot Index Header | The header information of the index used in the most recent boot |
Last Saved Config | The filename of the last saved configuration |
Time Last Saved | The time the configuration was most recently saved |
Changes Since Last Save | Yes: the configuration has changed since the last save |
No: the configuration has not changed since the last save | |
User Last Modified | The user name of the user who last modified the configuration file |
Time Last Modified | The time of the last modification |
Max Cfg/BOF Backup Rev | The maximum number of backup revisions maintained for a configuration file. This value also applies to the number of revisions maintained for the BOF file. |
Cfg-OK Script | URL: the location and name of the CLI script file executed following successful completion of the boot-up configuration file execution |
N/A: no CLI script file is executed | |
Cfg-OK Script Status | Successful/Failed: the results from the execution of the CLI script file specified in the Cfg-OK Script location |
Not used: no CLI script file was executed | |
Cfg-Fail Script | URL: the location and name of the CLI script file executed following a failed boot-up configuration file execution |
Not used: no CLI script file was executed | |
Cfg-Fail Script Status | Successful/Failed: the results from the execution of the CLI script file specified in the Cfg-Fail Script location |
Not used: no CLI script file was executed | |
Microwave S/W Package | n/a |
Management IP Addr | The management IP address and mask |
Primary DNS Server | The IP address of the primary DNS server |
Secondary DNS Server | The IP address of the secondary DNS server |
Tertiary DNS Server | The IP address of the tertiary DNS server |
DNS Domain | The DNS domain name of the node |
DNS Resolve Preference | n/a |
BOF Static Routes | To: the static route destination |
Next Hop: the next hop IP address used to reach the destination | |
Metric: displays the priority of this static route versus other static routes | |
None: no static routes are configured | |
ATM location ID | For ATM OAM loopbacks — the address of the network device referenced in the loopback request |
ICMP Vendor Enhancement: | Enabled — inserts one-way timestamp in outbound SAA ICMP ping packets |
Disabled — one-way timestamping is not performed on outbound SAA ICMP ping packets |
access-group
Syntax
Context
Description
This command displays access group information.
Parameters
Output
The following output is an example of access group information, and Table 25 describes the fields.
Table 25: Show System Access Group Fields
Label | Description |
Group name | The access group name |
Security model | The security model required to access the views configured in this node |
Security level | The required authentication and privacy levels to access the views configured in this node |
Read view | The view to read the MIB objects |
Write view | The view to configure the contents of the agent |
Notify view | The view to send a trap about MIB objects |
No. of access groups | The total number of configured access groups |
communities
Syntax
Context
Description
This command lists SNMP communities and characteristics.
Output
The following output is an example of communities information, and Table 26 describes the fields.
Table 26: Show Communities Output Fields
Label | Description |
Community | The community string name for SNMPv1 and SNMPv2c access only |
Access | r: The community string allows read-only access to all objects in the MIB except security objects |
rw: The community string allows read-write access to all objects in the MIB except security objects | |
rwa: The community string allows read-write access to all objects in the MIB including security objects | |
mgmt: The unique SNMP community string assigned to the management router | |
View | The view name |
Version | The SNMP version |
Group Name | The access group name |
No of Communities | The total number of configured community strings |
user
Syntax
Context
Description
This command displays user information.
Parameters
Output
The following output is an example of user information, and Table 27 describes the fields.
Table 27: Show User Output Fields
Label | Description |
User ID | The name of a system user |
Need New PWD | Yes: the user must change their password at the next login |
No: the user is not forced to change their password at the next login | |
User Permissions | Console: specifies whether the user is permitted console/Telnet access |
FTP: specifies whether the user is permitted FTP access | |
SNMP: specifies whether the user is permitted SNMP access | |
Password expires | The date on which the current password expires |
Attempted logins | The number of times the user has attempted to log in, irrespective of whether the login succeeded or failed |
Failed logins | The number of unsuccessful login attempts |
Local Conf. | Y: password authentication is based on the local password database |
N: password authentication is not based on the local password database |
view
Syntax
Context
Description
This command lists one or all views and permissions in the MIB-OID tree.
Parameters
Output
The following output is an example of system security view information, and Table 28 describes the fields.
Table 28: Show System Security View Output Fields
Label | Description |
View name | The name of the view. Views control the accessibility of a MIB object within the configured MIB view and subtree. |
OID tree | The Object Identifier (OID) value. OIDs uniquely identify MIB objects in the subtree. |
Mask | The mask value and the mask type, along with the oid-value configured in the view command, determines the access of each sub-identifier of an object identifier (MIB subtree) in the view |
Permission | Included: specifies to include MIB subtree objects |
Excluded: specifies to exclude MIB subtree objects | |
No-support: specifies not to support MIB subtree objects | |
No. of Views | The total number of configured views |
Group name | The access group name |