snmp community strings 1

[fenstrat]

How can I find the read/write community strings on my routers. I don't see any mention of it in the config files.

 

[baddos]

snmp-server community

 

[fenstrat]

When I telnet into the router, snmp-server community does not work when I log in or go to the enable mode. If I type ? there is no option available for snmp. It is a cisco 2600 router.

 

[fenstrat]

O.K. I figured out the snmp-server community string command. What is the difference between the public and private strings and how do you set each one of them seperately.

 

[nohair]

Hi,
First thing you should do is remove both public and private. Come up with your own strings using:
snmp-server community <string> <option> <acl>

Use it all for best security. The option refers to the type of access for someone using this string. You can have RO for read only and RW for read write. ACL is optional, this specifies an access-list of hosts allowed to communicate to your router using snmp. If you're not on the ACL and you nmap the snmp port you won't see it open.
Sample conf:

!
snmp-server community jkfrdfjs RO 6
!
access-list 6 permit host 172.1.1.10
!

BR,
-Stephen

 

[Urgentemente]

Fenstrat, when you say you &quot;figured out the snmp-server community string command&quot;

would you mind posting here what exactly you did.

I'm currently trying to setup mrtg to monitor/graph the traffic for a couple of 2501's I inherited as part of this position. However when I do 'show snmp' it gives '%SNMP agent not enabled'.

I also have a 2503 which has been configured by another IT dept and we have it as a spare at the moment, so I'm trying to use it as a guinea pig to avoid disrupting the live link.

snmp appears to be enabled on it as show snmp gives me the block of stats, but snmpwalk (or mrtg etc) fails to get any info from it. I do however see the number of errors rise when I try.
&quot;12 Bad SNMP version errors
459 Unknown community name
&quot;
the community name keeps rising when I try public/private etc.
I assume that means the previous configurer has changed the community names? As I have the enable password , could someone let me know what command it is to view the community names.

Sorry for the newbie questions, but almost 0% knowledge of Cisco kit apart from the basics of viewing interface stats etc.

many thanks,

 

[tschouten]

The %SNMP agnet not enabled means SNMP has not been configured at all. By default it is unconfigured for security reasons. You can create your own communities by using this command set below.

I used SNMPWALTEST as a word for my new community. I then used the question mark to show what other options were available. Notice it lets you use an ACL as well as the RO,RW options. You would then need to use the SNMPWALTEST on MRTG as the community string in order for it to read the router. (That is if you used that as a community name.) Like nohair described you can use the access-lists as well to limit access to the snmp community. For MRTG all you need is Read Only (RO).

Gateway(config)#snmp community SNMPWALTEST ?
<1-99> Std IP accesslist allowing access with this community string
<1300-1999> Expanded IP accesslist allowing access with this community
string
ro Read-only access with this community string
rw Read-write access with this community string
view Restrict this community to a named MIB view

 

[Urgentemente]

Managed to find the community strings for the 'spare' router (forgot the check the show config output , oops),
but even on that one, if I try the 'snmp community' command(s) at the enabled prompt, it says unknown command.
I notice on your post above that it has (config) after the router name, is there a certain mode you have to be in ? (i.e config mode..)

If that's the case, is there a way to just change the SNMP settings without affecting all the others, as I REALLY don't want to knock a live router off the network (it links our two main UK sites together).

thanks for the info so far tho.

 

[tschouten]

Changing SNMP communities won't knock the router offline. Yes you have to be in Global Config Mode to perform any changes to SNMP.

Router>en
Router#configure terminal
Router(config)#

 

[Urgentemente]

Great, thanks, I got into config mode, and (just as a test) changed the snmp-server location to something else, but 'show config' still shows the original details, from the bits I've seen I'm guessing this is to do with having one 'live/running' config, and one in memory? What's the correct sequence to make changes active? (and again, will it knock the router off at any point - e.g does it cause/need a reboot?)

thanks for the quick replies so far, haven't been able to persuade my boss to pay for a Cisco course yet :-(, so learning by fiddling.

 

[Urgentemente]

I think I've just seen the answer in another thread...


'write mem' ?

 

[tschouten]

That would be to write your running config to your startup config.

You can use copy start run (to copy startup to running)
Or you can also use: Copy run start (acts like wr mem, or write mem).