I´m trying to set snmp trap when cisco asa 5510 is changed.

I´m using this line:

snmp-server host DMZ ZZ.YY.XX.5 community *****

snmp-server enable traps entity config-change fru-insert fru-remove

But it doesn´t send any trap when I modify or save my config. Is it the right way?

In the cisco doc is not very clear what config-change means. http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/monitor_snmp.html The snmp-server enable traps entity config-change fru-insert fru-remove command is used to enable this notification.

What type of config-change refers ? hardware o system config file?


For mine I use:

snmp-server enable traps entity config-change

This captures any running or startup config changes. The fru-insert and fru-remove should capture hardware changes (not problems with existing but actual inserts or removals of modules).

I know you specified the community in the snmp-server host line but do you also have a line for snmp-server community ***** ?

I use snmp v3 so mine will look different than yours, but still, you should be right.

Are you sure it isn't sending traps though?

You can troubleshoot with various commands (or even using an snmpwalk tool like the one from Paessler):

To ensure that the SNMP process that receives incoming packets from the NMS is running, enter the following command:

hostname(config)# show process | grep snmp

To capture syslog messages from SNMP and have them appear on the ASA or ASASM console, enter the following commands:

hostname(config)# logging list snmp message 212001-212015

hostname(config)# logging console snmp

To make sure that the SNMP process is sending and receiving packets, enter the following commands:

hostname(config)# clear snmp-server statistics

hostname(config)# show snmp-server statistics

The output is based on the SNMP group of the SNMPv2-MIB.

To make sure that SNMP packets are going through the ASA or ASASM and to the SNMP process, enter the following commands:

hostname(config)# clear asp drop

hostname(config)# show asp drop

|improve this answer|||||
  • May be I need an extra ACL, because I´m trying to send traps to NON administrative interface. I do some packet traces and the traffic is denied from ASA to SNMP hosts, any idea? – POLLOX Oct 14 '13 at 8:42
  • 1
    I didn't notice your SNMP host was in the DMZ. That's actually pretty odd, but still. You'd need to allow traffic between interfaces (inside, dmz) as well as making sure your NAT between inside and DMZ is correct (either removed or static, whichever allows for the routes to work). Honestly though, I've never seen that type of SNMP setup and I'd be concerned about a host in your DMZ being accessible via the outside that is getting SNMP info/traps. – TheCleaner Oct 14 '13 at 13:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.