ARN Router - Known and Functioning Password is Missing from SNMP MIB

[mbd0722]

One known and functioning password is missing from SNMP MIB. I know the other two passwords, "password_A" and "password_B" within the SNMP MIB for accessing the router through Site Manager. These passwords are displayed within Site Manager 15.50, the Technicians Interface, and Site Manager's Report Generator text file output. There is one other "known" and working password, "password_C" that is only used by the Technicians Interface and Telnet for access. The "password_C" is not displayed anywhere including the wfSnmpCommEntry.wfSnmpCommName MIB. I would like to find "password_C" so that it can be changed. The Nortel (Bay) Networks ARN Router IOS code is 13.20. Please help. Thank You. This post was generated on 4/3/2013.

 

[andy88]

show snmp comm - This will list community's, read/write, managers

get wfSnmpCommEntry.3.* - This will list community's.

get wfSnmpCommEntry.3.*
wfSnmpCommEntry.wfSnmpCommName.1 = "public"
wfSnmpCommEntry.wfSnmpCommName.2 = "test"

Look at the number before the community you want to change i.e. .2 = "test"

If you now do, get wfSnmpCommEntry.3.* and replace * with 2 you will get

get wfSnmpCommEntry.3.2
wfSnmpCommEntry.wfSnmpCommName.2 = "test"

You can then do
set wfSnmpCommEntry.3.2 "change"
This should change the entry in the .2 position to "change"

get wfSnmpCommEntry.3.*
wfSnmpCommEntry.wfSnmpCommName.1 = "public"
wfSnmpCommEntry.wfSnmpCommName.2 = "change"

 

[mbd0722]

The functioning password that I want to remove is not displayed in the MIB list of get wfSnmpCommEntry.3.*. This is the problem. This password is also not displayed in the TI via "show snmp managers" and is not displayed using Site Manager via "Tools > Configuration Manager > Dynamic > Protocols > IP > SNMP > Communities". In attempt_#1, to remove the password, I have (1) entered the missing password into the SNMP Communites and (2) verified its entry with get wfSnmpCommEntry.3.*,"show snmp managers", and Site Manager. I then (3) booted the router with the modified "config". (4) Removed the password from the "config" file. (5) Booted the router again with this modified and saved "config" file. (6) Verified via Site Manager that the password was removed. (7) LOGGED IN WITH SUCCESS TO THE TI USING THE PASSWORD THAT WAS JUST REMOVED. (8) And verified that this password that I just used to login was removed via the MIB get wfSnmpCommEntry.3.* and "show snmp managers". In attempt_#2, to remove the password, I tried many attempts to boot into the Diagnostics Mode's "diag_1>" prompt by entering CTRL+C during BOOT but the router would continue to boot arn.exe and config files. I would have entered the "d/l/n:5 410000 0" command at the "diag_1>" prompt to remove the Manager's password.

 

[mbd0722]

I was later able was to boot into the Diagnostics Mode's "diag_1>" prompt by entering "CTRL+C+ENTER" during BOOT and I removed the password with the d/l/n:5 410000 0 command. I then booted the router with the "config" file which contains the password that I want to use. New Problem: I am able to login with Site Manager using the desired password but there is no request for a password when I login via the TI or with Telnet. I can now enter "Manager" at the login prompt and have full access. How can I secure Technician Interface and Telnet access? This must be accomplished some other way than using the MIB or Site Manager since the configuration seems to make no difference for TI and Telnet access. Thank You

 

[andy88]

From the TI prompt enter;

To change the Manager password
# password Manager

It should then prompt you to enter old (if no old password just hit enter) and new password

To changer the User password
# password User

 

[mbd0722]

PROBLEM FIXED - From the Technicians Interface I entered the command "password Manager". At the enter "Old Password" prompt I just hit the Enter key. At the enter "New Password", I entered the password that I wanted. Again I was prompted to enter "New Password", which I re-entered. This is for the Technicians Interface and Telnet access only. This has no relation to the SNMP settings within Site Manager, MIB wfSnmpCommEntry, or "show snmp communities". We demonstarted this on one ARN in the lab and one running at a remote site. The TI/Telnet Manager password must be written into the hardware's EEPROM and not on the flash or in configuration files. So the total fix was: (1) At the Technicians Interface boot into the Diagnostics Mode's "diag_1>" prompt by entering "CTRL+C+ENTER" during BOOT and remove the password with the "d/l/n:5 410000 0" command. (2) At the Technicians Interface enter "password Manager" > enter old password > enter new password > re-enter new password END. This was a learning experience for us since we thought that all passwords were contained within SNMP. Thank You

 

[mbd0722]

Thank you andy88 for your help. This was very much appreciated by all of us.