CiscoWorks IPM 4.1.0 - SNMP Community String Updates

Cisco NetPro,
We're running IPM 4.1.0 on Solaris 10.
Periodically we change SNMP RO/RW strings on our devices. I recently changed the strings on our devices and within IPM.
Now that they're changed, 26 of my collectors are appearing in the Source Not Responding list. Both my Source and Target devices have the same strings configured.
I need to verify the strings IPM has stored. I exported my collectors via the command line utility "ipm" and via the GUI and still no strings in the output.
How can I see the SNMP strings in IPM?
Stephanie

I ran "pdterm IPMProcess" followed by "pdexec IPMProcess" and now I'm getting this error:
Error
Error in communicating with IPMGroupAdministration Server.
It may be down or not yet up. Please make sure that the IPMGroupAdministration Server is up and running, then refresh the page.
Stephanie

Similar Messages

StorCenter px6-300d SNMP Community String

Dear Reader,
We have a NAS (StorCenter px6-300d) and we want to monitor it with our monitoring system.
On the Iomega website (http://iomega.com/resources/ui/px6-300d-313/help/help.html) i've found the configuration steps (see below) and configured our NAS.
Configuring SNMP settings
To enable SNMP, click the switch on.
Enter a unique username and password to define the community.
Confirm your password.
Enter the IP address of the host in the Trap Receivers text box. To grant access to multiple receivers, list all of them in the text box, separating each entry with a space.
Click Apply to save your settings
In our monitoring system we get the following msg: SNMP agent down - no response received. I think this is because of the (wrong) community string. In our monitoring system, under configuration tab, I tried 'public', 'username', 'password' etc in the community string field but it is not working.
I hope someone can help me with this... what is the community string? If i'm doing something else wrong then...
Thanks in advance.
With kind regards,
From the Netherlands
Solved!
Go to Solution.

Hi yunuz,
The username and password that you set on the NAS device needs to match on the SNMP server that you are trying to connect to. So use the same username and password for the server. Do you know what SNMP version your client is using?
What is an “SNMP Community String”?
The “SNMP Community string” is like a user id or password that allows access to a router's or other device's statistics. PRTG sends the community string along with all SNMP requests. If the community string is correct, the device responds with the requested information. If the community string is incorrect, the device simply discards the request and does not respond.
Note: SNMP Community strings are used only by devices which support SNMPv1 and SNMPv2c protocol. SNMPv3 uses username/password authentication, along with an encryption key.
By convention, most SNMPv1-v2c equipment ships from the factory with a read-only community string set to "public". It is standard practice for network managers to change all the community strings to customized values in the device setup.
Source: http://www.paessler.com/manuals/prtg_traffic_grapher/whatisansnmpcommunitystring
Have questions and need answers?
Search the database for answers to FAQ's, software/driver downloads, tutorials, news, features and more!
LenovoEMC Support & Downloads
LenovoEMC North America Support Contact Page

Pass SNMP community string a scripted monitor parameter in SCOM 2012

Hi,
Following the advice given here http://social.technet.microsoft.com/Forums/systemcenter/en-US/606d793c-b559-40b5-865a-ae312ee483d7/snmp-monitor-compare-oid-to-current-date
I created a scripted monitor to poll the value of a SNMP OID and compare it to the current system date.
It works perfectly fine, but I can't find how to pass the community string to the script in order to avoid having to hardcode it in clear text in the script... It seems this was published as a Target's Property with SCOM 2007 (like described here : http://www.burkard.it/2011/10/create-a-calculated-snmp-monitor/
) but that it's not the case anymore with SCOM 2012 (likely because SCOM 2012 now uses RunAs accounts to store community strings, I guess).
So, what is the correct way to achieve this?
Thanks!

Ok, I just found the solution myself, it was quite easy actually (but as often not really documented anywhere) :
you just have to pass this as a parameter :
$RunAs[Name="NetworkLibrary!System.NetworkManagement.Snmp.MonitoringAccount"]/CommunityString$
instead of the scom2007 property which was :
$Target/Property[Type="NetworkDeviceLibrary!Microsoft.SystemCenter.NetworkDevice"]/CommunityString$
And that's it, you don't even need to decode the string in your script as it was the case with scom 2007.

View snmp community string

Maybe I am missing something here but it looks like once you set the snmp community name, it is blanked out from display and can't be viewed again. No luck via the CLI also.
Is this actually true or am I just missing something here?? If the community name is hidden then how does one view the same?
Thanks,
GD

From NXOS, for example.
bdsol-6120-05-A# connect nxos
bdsol-6120-05-A(nxos)# sh run | i community
snmp-server community CISCO group network-operator

Is it possible to configure an SNMP copmmunity string on an ATA 186 without accessing it via console?

I am trying to configure a particular SNMP community string on many ATAs for a Cisco 'Know the Network' project. On a Cisco ATA 186, you cannot telnet or SSH to it and the only way to remotely change the parameters are via the web GUI, which doesn't have the SNMP field available.
Is this possible without getting physical console access to the ATA?

No.
An ASA can, as you noted, restrict source and destination IP and port. To do what you are asking, one would need to prevent a string within the payload from being transmitted (or only accept certain strings).
You should just put the access-list on the destination device(s) restricting what host(s) are allowed snmp rw (as you alluded to). That's a very common implementation straight out of the textbook.

Is the "Community" string hardcoded somewhere in SEA?

Hi
I have a machine installed with SEA 1.0.3 and developed a Subagent by myself. I want to change the Community String for security reason but encountered some problem.
I updated the community string in snmpd.conf and myagent.acl at /etc/snmp/conf. Then I stop snmpdx and start it again with "-d 4". At another terminal, I start my subagent with "-d 4" too, there is some PDU print out on the screen as follows:
SSASubagent called with mysubagent
PDU:
version: 0
community: public
type: SET_REQ_MSG (0xa3)
request id: 0
error status: noError(0)
error index: 0
name: 1.3.6.1.4.1.42.2.15.5.0
type: OCTET STRING (0x4)
length: 9
value: mysubagent ( 73 6f 67 61 6c 61 72 6d 64 )
MANAGERS:
* 0
COMMUNITIES(READ_WRITE): myprivate mypublic
#EFILTER:
TRAP RECIPIENTS:
Waiting for incoming SNMP requests on UDP port 7041
You can see from the beginning that the community print out is still "public". But at the bottom of the print out, the community has been changed.
I have 2 questions on this:
1. Since I have not any SNMP server running and I did not send any GET/SET request to my agent, I think this PDU is the registration PDU my subagent send to the master agent for register. Am I right?
2.If I update the community string in snmpdx.acl, my subagent can not start up successfully and there is some print out in the master agent site that "community_check() : bad community from myhost ". It seems that it is because the community string in the PDU is still "public" and which is different with what master agent set.
3.I'm using Solaris 5.9. Do I need some patch for this issue?
I have read the User Guide and Developer Guide of SEA but still can not resolve it , would you give some information on this?
thanks a lot
Wendy

> Is it possible in cs-mars to change the community string on multiple devices?
Yes, it's possible for some device types. The SNMP community string(s) can be bulk updated using a seed file, but only for the following device types: PIX, PIX 7.x, ASA, IOS, and SWITCH-IOS. Any other device types have to be updated manually. The details are on page 1-46 of the Device Configuration Guide. You will also need the details for using a seed file, from the same document.
> is this absoluteley necessary?
If you want to communicate with the devices via SNMP, then yes, you need to update the strings. This is especially the case if you don't use any other communications protocols such as SSH, Telnet, or FTP. Also, without the updated SNMP strings, MARS can't fully discover the Layer 2 topology from the device.
Unfortunately, the SNMP string bulk update is only available for SNMPv1 (or v2 with no encryption) credentials. If you're using SNMPv3, each device has to be edited manually.

Disable default read community string

I would like to know the procedure to disable the default read community string which is "public" and change create a new read community string using SMC 3.0

In your topology view, right click on a host, select "Attribute Editor". Then click the "Security" tab. There are sections here to control the user and group access control as well as the SNMP community string settings for the agent. You can make changes to the community string and hit "OK".
Regards,
Jeff Grabell
www.cirba.com

Cs-mars changing the community string on multiple devices

Hello,
We've changed the snmp v2 community strings on all the network devices.
Is it possible in cs-mars to change the community string on multiple devices?
When I select edit in admin>security and monitor devices> and select several devices and click edit the message "please select only one device to edit"
What's the best way to do this, and is this absoluteley nessecary?
Many thanks for all the help......

> Is it possible in cs-mars to change the community string on multiple devices?
Yes, it's possible for some device types. The SNMP community string(s) can be bulk updated using a seed file, but only for the following device types: PIX, PIX 7.x, ASA, IOS, and SWITCH-IOS. Any other device types have to be updated manually. The details are on page 1-46 of the Device Configuration Guide. You will also need the details for using a seed file, from the same document.
> is this absoluteley necessary?
If you want to communicate with the devices via SNMP, then yes, you need to update the strings. This is especially the case if you don't use any other communications protocols such as SSH, Telnet, or FTP. Also, without the updated SNMP strings, MARS can't fully discover the Layer 2 topology from the device.
Unfortunately, the SNMP string bulk update is only available for SNMPv1 (or v2 with no encryption) credentials. If you're using SNMPv3, each device has to be edited manually.

Cisco Works SNMP write community string Incorrect

Hi,
I have installed Cisco Works at my organisation. Under RME -> Inventory -> Import status -> Device Attribute Error: I am getting: Incorrect SNMP write community strings. Even though i know perfectly well the SNMP write community string is correct. To prove that, if I delete the device and then add the same device using the same SNMP write community string it works fine. then a couple of days later, it comes up with the same message "SNMP write community string is incorrect". I have increased the time and retries for the SNMP settings at the ANI server, still it has not resolved the issue.
Please help

I have sharched the CCO bug toolkit and according them, it was a know issue for verion 3.4 but it has been fixed for Ver RME 3.5. But we are currently running RME 3.5, therefore it does not make any sense.

-=SNMP community=- how to encrypt???

I am administrating the network devices of organisation @A@ and @B@
I have got a community string for SNMP. I am gonna use the same one for both organisations.
organisation @B@ can run in GLOUB MODE "show run"
so @B@ know community string for SNMP.
could the @B@ have access to @A@? If yes, HOW to FIX it???

The community strings cannot be encrypted. That is the nature of community string-based SNMP. You should consider switching to SNMPv3 which uses hashed user credentials. In this case, you will not see the credentials in the output of "show run". See https://www.cisco.com/en/US/tech/tk648/tk362/technologies_tech_note09186a0080094489.shtml for more on securing SNMP.

Cat6k responds much slower to one SNMP RO string than another

Not sure what to make of this, but I'm running into a 6509 that takes >90s to respond to queries from the Nagios check_ifstatus plugin
when a particular SNMP RO string is used. It responds "normally" (within a few secs) if an alternate RO string is substituted in. Both strings are configured identically, according to the network staff. I don't have access to the full configs. I can't think of what might cause this kind of behavior. Any ideas on what to check for are much appreciated.

This does sound strange, and it's not something I've heard before. I would have to think that either there is some difference in the SNMP configuration (views applied, ACL, etc.) or perhaps the problematic string contains a '@' and the switch is evaluating it with community string indexing rules.
Before any kind of troubleshooting can begin, you'd need to get the show ver and show run. It may also be helpful to get a sniffer trace just to see if anything on the network might be throttling SNMP responses based on community string (would be strange, but you never know). Seeing the switch's CPU utilization at each poll would be helpful, too. Perhaps it's coincidental that one string appears to take longer than another. Perhaps something else is happening on the switch that is driving up CPU utilization at the same time.

Besides a RW community string...

Besides a RW community string on Wired switches and routers in Prime Infrastructure, are there any other special configurations required (on the Wired switch or router side) in order for the templates to be deployed.
Reason I'm asking is in my lab when I go to deploy canned templates, there aren't any devices that show in the available devices list....granted I have only 1-3560 Wired switch setup at this time.
Also I saw a couple of instances today on different builds where I was able to see devices in the list:::
thanks for any feedback.
rob

it was a browser problem:::

VS Community With Update 4: Uninstall/Repair: "Setup Failed"

So, I may have goofed up this time. So let's start from the beginning. I installed VS Community W/ Update 4 about a month or two ago. (I installed portions on my external because I want to save space on my SSD). I uninstalled it because I didn't think I
would need it again. When uninstalling VS it wouldn't fully uninstall (I think I uninstalled some components in the incorrect order). Now when I try to repair it or uninstall VS, I get this message: "Setup Failed! install cannot continue because required
components failed".
I am trying to re-install VS so I can use it for another project. I checked a few sources online, but nothing seems to make any sense or simply is not ineffective. Can some one help make sense of this?

Hi ntnguyen.victory,
According to the name of the installer "vs2013.4.exe", I think what you download is the update 4 for VS2013 instead of VS2013 with update 4.
You can check the update 4 download page:https://www.microsoft.com/en-us/download/details.aspx?id=44921
and the VS2013 with update 4 download page:http://www.visualstudio.com/downloads/download-visual-studio-vs
So when you right clicked file vs2013.4.exe in that folder, cliked Run as Administrator, it didn't work because you didn't install VS2013.
Please download VS2013 with update 4 with the link I paste.
Best regards,
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

I have an older IMAC running 10.6.8. No more than 4GB available. Cox Communication just updated my email service, which requires 10.7 or greater. I can use my email but cannot attach a document. Any help?

I have an older Imac running 10.6.8 with 4 GB capacity. Cox Communications just updated the email service, now I cannot attach a document to an email. Cox says my operating system not compatible. Any suggestions?

If Firefox doesn't work, check that your computer is compatible with Mountain Lion/Mavericks/Yosemite.
To check the model number hold down the option/alt key, go to the Apple menu and select System Information.
iMac (Mid 2007 or newer) model number 7,1 or higher
Your Mac needs:
OS X v10.6.8 or OS X Lion already installed
2 GB or more of memory (More is better - 4 GB minimum seems to be the consensus)
8 GB or more of available space
Check to make sure your applications are compatible. PowerPC applications are no longer supported after 10.6.
Application Compatibility
Applications Compatibility (2)
Do a backup before installing.

Changing public community string in snmpd.conf & snmpdx.acl fills /var 100%

Hi,
we have a security concern dealing with our SEA agent dealing with community names...
We want to be able to change the comminity names in the config files so that public, private does not show up anywhere.
The system is running Solaris 8. When we change the community setting we keep getting these errors:
Nov 29 16:38:06 test01 /usr/lib/snmp/snmpdx: [ID 702911 daemon.error] community_check();bad community from localhost
Nov 29 16:38:06 test01 /usr/lib/snmp/snmpdx: [ID 702911 daemon.error] session_open() failed for a pdu received from localhost.41927
These are the changes made to the snmpd.conf file:
system-group-read-community test01tes01
read-community test01test01
Changes made to snmpdx.acl
acl = {
communities = test01test01
access = read-only
managers = *
Now, the only way to get rid of the error messages is to insert the public entry back under communities. Else /var gets 100% & causes issues.
Has anybody been able to remove the public entry and get this working with Solaris 8

N/m...found my answer...I needed to change my /System/Libary/LaunchDaemonds/org.net-snmp.snmpd.plist to not disabled.

CiscoWorks IPM 4.1.0 - SNMP Community String Updates

Similar Messages

Maybe you are looking for