Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I´m trying to set snmp trap when cisco asa 5510 is changed.

I´m using this line:

snmp-server host DMZ ZZ.YY.XX.5 community *

snmp-server enable traps entity config-change fru-insert fru-remove

But it doesn´t send any trap when I modify or save my config. Is it the right way?

In the cisco doc is not very clear what config-change means. http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/monitor_snmp.html The snmp-server enable traps entity config-change fru-insert fru-remove command is used to enable this notification.

What type of config-change refers ? hardware o system config file?

share|improve this question

1 Answer 1

For mine I use:

snmp-server enable traps entity config-change

This captures any running or startup config changes. The fru-insert and fru-remove should capture hardware changes (not problems with existing but actual inserts or removals of modules).

I know you specified the community in the snmp-server host line but do you also have a line for snmp-server community ***** ?

I use snmp v3 so mine will look different than yours, but still, you should be right.

Are you sure it isn't sending traps though?

You can troubleshoot with various commands (or even using an snmpwalk tool like the one from Paessler):

To ensure that the SNMP process that receives incoming packets from the NMS is running, enter the following command:

hostname(config)# show process | grep snmp

To capture syslog messages from SNMP and have them appear on the ASA or ASASM console, enter the following commands:

hostname(config)# logging list snmp message 212001-212015

hostname(config)# logging console snmp

To make sure that the SNMP process is sending and receiving packets, enter the following commands:

hostname(config)# clear snmp-server statistics

hostname(config)# show snmp-server statistics

The output is based on the SNMP group of the SNMPv2-MIB.

To make sure that SNMP packets are going through the ASA or ASASM and to the SNMP process, enter the following commands:

hostname(config)# clear asp drop

hostname(config)# show asp drop

share|improve this answer
    
May be I need an extra ACL, because I´m trying to send traps to NON administrative interface. I do some packet traces and the traffic is denied from ASA to SNMP hosts, any idea? –  POLLOX Oct 14 '13 at 8:42
1  
I didn't notice your SNMP host was in the DMZ. That's actually pretty odd, but still. You'd need to allow traffic between interfaces (inside, dmz) as well as making sure your NAT between inside and DMZ is correct (either removed or static, whichever allows for the routes to work). Honestly though, I've never seen that type of SNMP setup and I'd be concerned about a host in your DMZ being accessible via the outside that is getting SNMP info/traps. –  TheCleaner Oct 14 '13 at 13:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.