Questions? Call 1.800.716.8955

Chapter 26

SNMP, Syslog, SSH and File Transfer

Exam topics covered

4.4 Explain the function of SNMP in network operations

4.5 Describe the use of syslog features including facilities and levels

4.8 Configure network devices for remote access using SSH

4.9 Describe the capabilities and functions of TFTP/FTP in the network

Foundation. A network that works today must still be watched, managed and maintained tomorrow. This chapter covers the everyday tools of network operations. SNMP lets a management station poll devices for counters and receive alerts. Syslog records what each device has to say about itself, ranked by severity. SSH gives you an encrypted command line from anywhere, replacing insecure Telnet. And TFTP and FTP move configuration backups and software images to and from devices. Each is simple on its own; together they are how real networks are run. All CLI output is illustrative of Cisco IOS 15 and IOS XE; minor formatting differs between releases. The examples use one small management topology: router R1 (G0/1 192.168.1.1) connects through switch SW1 to a management server at 192.168.1.50 that runs the SNMP manager, a syslog server and a TFTP/FTP server, and an administrator PC at 192.168.1.100.

26.1 Simple Network Management Protocol

Nobody can watch 300 switches by logging in to each one; SNMP automates monitoring. Three pieces work together:

The SNMP manager, part of a network management system (NMS) such as SolarWinds, PRTG, LibreNMS or Cisco Catalyst Center, which polls devices, graphs the results and raises alarms.

The SNMP agent, software on each managed device (router, switch, server, printer) that answers the manager and sends notifications.

The Management Information Base (MIB), the structured set of variables an agent exposes. Each variable is named by an object identifier (OID), a dotted number that locates it in a global tree.

  • SNMP manager (NMS) SNMP agent (R1)
  • Get / GetNext / GetBulk "What is ifInErrors on Gi0/1?"
  • to agent UDP 161
  • Response "ifInErrors.2 = 17"
  • Set "ifAdminStatus.2 = down(2)" (requires write access)
  • Trap or Inform "linkDown on Gi0/2" (agent-initiated)
  • to manager UDP 162 · Inform is acknowledged, Trap is not

Mib

Figure 26-1 SNMP manager, agent and MIB. Requests go to the agent on UDP 161; traps and informs go to the manager on

Udp 162.

26.1.1 OIDs and the MIB tree

Standard MIB objects live under the mib-2 branch (1.3.6.1.2.1); vendors add private MIBs under enterprises (1.3.6.1.4.1), and Cisco's branch is 1.3.6.1.4.1.9. A manager can ask for a single object by OID or walk a whole branch with repeated GetNext (or GetBulk) requests.

Figure 26-2 traces the OID for a device's host name.

iso (1) org (3) dod (6) internet (1) mgmt (2) mib-2 (1) system (1) sysName (5) private (4) enterpr. (1) cisco (9)

  • 1.3.6.1.2.1.1.5.0
  • sysName.0 = "R1"
  • 1.3.6.1.4.1.9
  • root

Standard MIB-II objects (blue) and vendor-private MIBs (green) share the 1.3.6.1 prefix

Figure 26-2 Walking the OID tree to sysName. The trailing .0 identifies the single instance of a scalar object.

In summary: Get reads one or more OIDs; GetNext reads the next OID in the tree and is repeated to "walk" a table; GetBulk (v2c and v3) reads many OIDs in one request; Set changes a value and needs read-write access; a Trap is an unsolicited, unacknowledged notification from the agent; an Inform (v2c and v3) is a notification the manager acknowledges, so the agent resends it if no acknowledgment arrives.

26.1.2 SNMP versions and security

SNMPv1 and SNMPv2c authenticate with a community string, effectively a password sent in clear text in every packet, with read-only (RO) or read-write (RW) access. SNMPv3 replaces communities with named users and groups and adds real authentication and encryption, chosen per group as a security level (Table 26-1).

Table 26-1 SNMP versions and security levels

  • Version / level Authentication Encryption Notes
  • v1 Community string
  • (clear text)

No Original; 32-bit counters; traps only.

  • v2c Community string
  • (clear text)
  • No Adds GetBulk, Inform and 64-bit

counters.

v3

noAuthNoPriv

Username only No Rarely used.

v3 authNoPriv HMAC (MD5 or SHA) No Messages are authenticated and integrity-checked.

  • v3 authPriv HMAC (MD5 or SHA) Yes (DES, 3DES,
  • AES)
  • Recommended: authenticated and

encrypted.

! SNMPv2c: read-only community, restricted by ACL 10 to the NMS

R1(config)# access-list 10 permit host 192.168.1.50
R1(config)# snmp-server community N0c-R3ad RO 10
R1(config)# snmp-server location Toronto-DC1-Rack4
R1(config)# snmp-server contact noc@example.com
R1(config)# snmp-server host 192.168.1.50 version 2c N0c-R3ad
R1(config)# snmp-server enable traps
! SNMPv3: authPriv group and user
R1(config)# snmp-server group NOC v3 priv
R1(config)# snmp-server user nms1 NOC v3 auth sha Auth#Pass1 priv aes 128 Priv#Pass1
R1(config)# snmp-server host 192.168.1.50 version 3 priv nms1

Exam alert

Know the ports (agent UDP 161, manager UDP 162 for traps and informs), the difference between a trap (unacknowledged) and an inform (acknowledged), and that only SNMPv3 provides authentication and encryption; authPriv is the level that encrypts.

26.2 Syslog

Every Cisco device constantly reports on itself: interfaces going up and down, configuration changes, failed logins, neighbor changes, hardware alarms. These are syslog messages. They are shown on the console by default and can also be kept in memory, shown to remote sessions and sent to a central syslog server (UDP port 514) where they can be searched and correlated across the whole network.

26.2.1 Message format

A Cisco log message has a fixed structure (Figure 26-3). The facility names the part of the software that generated it, such as LINK, LINEPROTO, OSPF or SYS; the severity is a number from 0 to 7; the mnemonic is a short code for the specific event; and the description gives the details. The optional sequence number and the time-stamp format are controlled by service commands.

000045: *Oct 4 09:15:02.517: %LINK -3- UPDOWN: Interface Gi0/2, changed state to down Seq. no.

service timestamps log datetime msec * = clock not authoritative (no NTP)

Figure 26-3 Anatomy of a Cisco syslog message: sequence number, time stamp, facility, severity, mnemonic and description.

26.2.2 Severity levels

Severity is the most heavily tested part of syslog. Lower numbers are more severe. When you set a logging level for a destination, the device sends messages at that level and every more severe (lower-numbered) level. Level 7, debugging, therefore includes everything.

Table 26-2 Syslog severity levels

  • Level Keyword Meaning Example
  • 0 emergencies System is unusable Device about to crash
  • 1 alerts Immediate action needed Temperature critical
  • 2 critical Critical condition Memory allocation failure
  • 3 errors Error condition %LINK-3-UPDOWN

4 warnings Warning condition Duplicate address, port-security violation 5 notifications Normal but significant %LINEPROTO-5-UPDOWN, %SYS-5-CONFIG_I 6 informational Informational %OSPF-6-..., ACL log hits

7 debugging Debug output Output of debug commands

Tip

Memorize the order with a mnemonic: Every Awesome Cisco Engineer Will Need Ice cream Daily = Emergency, Alert, Critical, Error, Warning, Notification, Informational, Debugging (0 to 7).

26.2.3 Destinations and configuration

IOS can send each message to four kinds of destination, each with its own severity threshold (Figure 26-4).

  • R1
  • Console line
  • logging console <level>
  • on by default, level 7

Ram

Figure 26-4 The four syslog destinations and the command that sets each one's severity threshold.

Two behaviors catch people out. First, log messages are not shown in an SSH or Telnet session until you type terminal monitor in that session (it lasts only for that session). Second, messages printed to the console interrupt whatever you are typing; logging synchronous on the line reprints your partial command afterwards. The configuration below is typical:

R1(config)# service timestamps log datetime msec localtime show-timezone
R1(config)# service sequence-numbers
R1(config)# logging console warnings ! levels 0-4 to the console
R1(config)# logging buffered 16384 informational ! 16 KB buffer, levels 0-6
R1(config)# logging monitor debugging
R1(config)# logging host 192.168.1.50 ! syslog server
R1(config)# logging trap informational ! threshold for the server (default)
R1(config)# logging facility local5 ! facility tag seen by the server
R1(config)# logging source-interface Loopback0
R1(config)# line console 0
R1(config-line)# logging synchronous

Note the second meaning of facility. Inside the message, the facility (LINK, OSPF) names the IOS process. On the wire, the syslog protocol also carries a syslog facility code that the server uses to sort messages into files; network devices conventionally use local0 through local7, and Cisco IOS defaults to local7.

R1# show logging

Syslog logging: enabled (0 messages dropped, 2 messages rate-limited, 0 flushes, 0 overruns) Console logging: level warnings, 14 messages logged, xml disabled Monitor logging: level debugging, 0 messages logged, xml disabled Buffer logging: level informational, 61 messages logged, xml disabled Trap logging: level informational, 65 message lines logged

Logging to 192.168.1.50 (udp port 514, audit disabled, link up), 65 message lines logged, 0 message lines rate-limited,

xml disabled, sequence number enabled

Log Buffer (16384 bytes):

000043: Oct 4 09:12:40.101 EDT: %SYS-5-CONFIG_I: Configured from console by admin on vty0 000044: Oct 4 09:15:02.513 EDT: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/2, changed state to down

000045: Oct 4 09:15:02.517 EDT: %LINK-3-UPDOWN: Interface GigabitEthernet0/2, changed state to down

000046: Oct 4 09:16:11.874 EDT: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: root]

Figure 26-5 show logging : the threshold for each destination, the remote server, and the buffered messages with sequence numbers and millisecond time stamps.

Exam alert

" logging trap 4 " sends levels 0 to 4 to the server, not just level 4. logging trap controls the syslog server (it has nothing to do with SNMP traps). Remote sessions need terminal monitor to see messages.

26.3 Secure Remote Access with SSH

Administrators reach devices over the network through the virtual terminal (vty) lines. Telnet (TCP 23) sends everything, including the username and password, as clear text that anyone capturing traffic can read. Secure Shell (SSH), TCP 22, encrypts the whole session and authenticates the server with a key so that clients can detect impersonation. SSH version 2 is the only acceptable choice today; version 1 has known weaknesses.

Table 26-3 Telnet versus SSH

Feature Telnet SSH (v2)

Port TCP 23 TCP 22

Encryption None: credentials and commands in clear text Entire session encrypted Server authentication None RSA host key fingerprint

26.3.1 Configuration steps

SSH needs an RSA key pair, and IOS names the key after the device's fully qualified domain name, so a host name (other than the default "Router") and a domain name must exist first. Then create local users, tell the vty lines to authenticate against them, and permit only SSH.

Router(config)# hostname R1 ! 1. non-default host name
R1(config)# ip domain name example.com ! 2. domain name
R1(config)# crypto key generate rsa modulus 2048 ! 3. RSA keys (768+ bits for v2)
R1(config)# ip ssh version 2 ! 4. SSHv2 only
R1(config)# username admin privilege 15 secret Str0ng!Pass ! 5. local user
R1(config)# line vty 0 15
R1(config-line)# login local ! 6. use the local user database
R1(config-line)# transport input ssh ! 7. SSH only, no Telnet
R1(config-line)# exec-timeout 10 0
R1(config-line)# access-class 10 in ! optional: permitted source IPs

Generating the key automatically enables the SSH server (Figure 26-6). If you skip the host name or domain name, IOS refuses with "Please define a hostname other than Router" or "Please define a domain-name first". Optional hardening includes ip ssh time-out 60 and ip ssh authentication-retries 3 . Switches need the same steps plus a management SVI and default gateway.

R1 — console

R1(config)# crypto key generate rsa modulus 2048

The name for the keys will be: R1.example.com

% The key modulus size is 2048 bits

% Generating 2048 bit RSA keys, keys will be non-exportable...

[OK] (elapsed time was 2 seconds)

R1(config)#

*Oct 4 09:20:11.302: %SSH-5-ENABLED: SSH 2.0 has been enabled

Figure 26-6 The key pair is named host.domain, and creating it enables the SSH server.

26.3.2 Verifying SSH

show ip ssh shows whether SSH is enabled and which version; show ssh lists active sessions (Figure 26-7). From another Cisco device you connect with ssh -l admin 192.168.1.1 ; from a PC, use any SSH client such as OpenSSH ( ssh admin@192.168.1.1 ) or PuTTY.

R1 — console

R1# show ip ssh

SSH Enabled - version 2.0

Authentication methods:publickey,keyboard-interactive,password Encryption Algorithms:aes128-ctr,aes192-ctr,aes256-ctr

Authentication timeout: 120 secs; Authentication retries: 3

R1# show ssh
  • Connection Version Mode Encryption Hmac State Username
  • 0 2.0 IN aes256-ctr hmac-sha2-256 Session started admin
  • 0 2.0 OUT aes256-ctr hmac-sha2-256 Session started admin

%No SSHv1 server connections running.

Figure 26-7 SSH version 2 enabled, and one administrator connected over vty 0.

Be ready to put the SSH steps in order and to spot the missing one: host name, domain name, RSA key (modulus at least 768 for SSHv2; 2048 recommended), ip ssh version 2 , local username, login local and transport input ssh on the vty lines. login (without local ) uses the line password instead of usernames.

26.4 TFTP and FTP

Network devices need a way to move files: configuration backups out, configuration templates in, and new operating system images in. Two protocols dominate. The Trivial File Transfer Protocol (TFTP) is tiny: it runs over UDP port 69, has no authentication and no directory listing, and moves data in lock step, one 512-byte block per acknowledgment, with its own simple retransmission. That simplicity suits boot ROMs and IP phones but makes TFTP slow and unsafe across untrusted networks. The File Transfer Protocol (FTP) runs over TCP, requires a username and password, supports directory operations and is much faster for large images. FTP uses two connections: a control connection to TCP 21 for commands, and a separate data connection, from server port TCP 20 in active mode or to a server-chosen port in passive mode (Figure 26-8). Neither protocol encrypts; where that matters, use SCP or SFTP over SSH.

  • FTP (TCP, authenticated)
  • TFTP (UDP 69, no authentication)
  • Control connection to TCP 21: USER, PASS, RETR image.bin

Data connection: file contents (TCP 20 active, or passive port)

  • TCP handles sequencing, windowing and retransmission
  • Read request (RRQ) "image.bin" to UDP 69
  • DATA block 1 (512 bytes)
  • ACK block 1
  • DATA block 2 ... one block in flight at a time
  • client server

Figure 26-8 FTP uses separate control and data TCP connections; TFTP sends one block and waits for its acknowledgment.

Table 26-4 TFTP versus FTP

The IOS copy command uses URL-style prefixes such as tftp: , ftp: , scp: and flash: . Copying the running configuration to a server is the simplest backup (Figure 26-9). For FTP, set credentials first with ip ftp username and ip ftp password , or embed them in the URL.

R1 — console

R1# copy running-config tftp:

Address or name of remote host []? 192.168.1.50

Destination filename [r1-confg]? R1-2026-10-04.cfg

!!

3104 bytes copied in 0.512 secs (6062 bytes/sec)

R1# copy startup-config ftp://backup:Bkp#2026@192.168.1.50/R1-startup.cfg

Writing R1-startup.cfg !

3104 bytes copied in 0.208 secs (14923 bytes/sec)

Figure 26-9 Backing up to TFTP and to FTP (credentials embedded in the URL). Each ! represents data successfully transferred.

26.4.2 Upgrading the IOS image

An upgrade follows a predictable sequence: check flash space, copy the new image, verify its integrity, point the boot loader at it, save and reload. Keep the old image as a fallback if space allows. The router boots the first boot system image it finds valid; with no boot system commands it boots the first image in flash. Remember that boot system is configuration: save it before you reload, or it is ignored.

R1# show flash:
-#- --length-- -----date/time------ path

1 110458112 Jan 15 2025 10:22:16 +00:00 c2900-universalk9-mz.SPA.157-3.M8.bin 145903616 bytes available (110461216 bytes used)

R1# copy tftp: flash:

Address or name of remote host []? 192.168.1.50

Source filename []? c2900-universalk9-mz.SPA.157-3.M9.bin

Destination filename [c2900-universalk9-mz.SPA.157-3.M9.bin]?

Loading c2900-universalk9-mz.SPA.157-3.M9.bin from 192.168.1.50 (via GigabitEthernet0/1): !!!!!!! [OK - 110794752 bytes]

R1# verify /md5 flash:c2900-universalk9-mz.SPA.157-3.M9.bin

verify /md5 (flash:c2900-universalk9-mz.SPA.157-3.M9.bin) = 6a1f3c09e2b7d48a51c0e9f37d2b6a44

R1(config)# boot system flash:c2900-universalk9-mz.SPA.157-3.M9.bin
R1(config)# boot system flash:c2900-universalk9-mz.SPA.157-3.M8.bin ! fallback
R1# copy running-config startup-config
R1# reload

...

R1# show version | include image

System image file is "flash:c2900-universalk9-mz.SPA.157-3.M9.bin"

Figure 26-10 An IOS upgrade: copy the image from TFTP, verify the MD5 hash against the value published by Cisco, set boot system , save and reload.

LAB Secure Management: SSH, Syslog, SNMP and Backups

Goal: make R1 manageable only over SSH, send its logs and SNMPv3 traps to the management server, and back up its configuration to TFTP.

Figure 26-11 Lab topology, subnet 192.168.1.0/24.

Steps:

  • 1. Configure SSH as in Section 26.3.1, with access-list 10 permit 192.168.1.0 0.0.0.255 applied by access-class 10 in on the vty lines. Ensure Loopback0 has address 10.255.0.1/32.
  • 2. Configure service timestamps log datetime msec , logging host 192.168.1.50 , logging trap informational and logging buffered 16384 informational .
  • 3. Configure the SNMPv3 group NOC (priv) and user nms1, and snmp-server host 192.168.1.50 version 3 priv nms1 with snmp-server enable traps .
  • 4. From the admin PC run ssh admin@192.168.1.1 , then terminal monitor . Shut and re-enable Loopback0 to generate log messages.
  • 5. Back up the configuration with copy running-config tftp: .

Verify:

admin@192.168.1.1 — SSH

R1# terminal monitor
R1# show ssh | include admin

0 2.0 IN aes256-ctr hmac-sha2-256 Session started admin

R1# show logging | include Trap|Logging to

Trap logging: level informational, 72 message lines logged

Logging to 192.168.1.50 (udp port 514, audit disabled, link up),

R1# show snmp user | include name|Protocol

User name: nms1 Authentication Protocol: SHA Privacy Protocol: AES128 *Oct 4 10:02:31.410: %LINK-5-CHANGED: Interface Loopback0, changed state to administratively down

Figure 26-12 Expected results inside the SSH session: SSHv2 session, syslog server active, SNMPv3 user with SHA

and AES, and live log output thanks to terminal monitor .

Expected results: Telnet to 192.168.1.1 is refused; SSH succeeds only with the local username. The syslog server receives the Loopback0 messages (facility local7), the NMS receives linkDown/linkUp traps, and the TFTP server holds the backup file. Chapter review

  • Key terms
  • SNMP manager
  • SNMP agent

Mib

Oid

Ssh

  • RSA key pair
  • vty
  • login local
  • transport input ssh

Tftp

Ftp

boot system

Review questions

  • 1. Which SNMP message is sent by an agent and acknowledged by the manager?
  • A. Trap
  • B. Inform
  • C. GetResponse
  • D. Set
  • 2. Which UDP port does an SNMP manager listen on for traps?
  • A. 161
  • B. 162
  • C. 514
  • D. 69
  • 3. Which two statements about SNMP versions are true? (Choose two.)
  • A. SNMPv2c encrypts community strings
  • B. SNMPv3 authPriv provides authentication and encryption
  • C. SNMPv2c added GetBulk
  • D. SNMPv1 supports informs
  • E. SNMPv3 uses only community strings
  • 4. A router has logging trap warnings . Which severity levels go to the syslog server?
  • A. 4 only
  • B. 0 through 4
  • C. 4 through 7
  • D. 0 through 3
  • 5. In %OSPF-5-ADJCHG: Process 1, Nbr 2.2.2.2 ... from LOADING to FULL , what are "OSPF" and "5"?
  • A. Mnemonic and facility
  • B. Facility and severity
  • C. Severity and sequence number
  • D. Process name and priority
  • 6. Which severity level name corresponds to level 6?
  • A. Notifications
  • B. Debugging
  • C. Informational
  • D. Warnings
  • 7. An administrator connected through SSH does not see log messages. What should she do?
  • A. Configure logging console
  • B. Enter terminal monitor
  • C. Configure logging synchronous
  • D. Enter logging buffered
  • 8. Which two commands are required before crypto key generate rsa succeeds on a new router? (Choose two.)
  • A. hostname
  • B. ip domain name
  • C. ip ssh version 2
  • D. transport input ssh
  • E. login local
  • 9. Which vty line command allows SSH but rejects Telnet?
  • A. login local
  • B. transport input ssh
  • C. transport output ssh
  • D. ip ssh version 2
  • 10. Which command confirms that SSH version 2 is enabled?
  • A. show ssh
  • B. show ip ssh
  • C. show crypto key
  • D. show line vty
  • 11. Which two statements describe TFTP? (Choose two.)
  • A. It uses UDP port 69
  • B. It requires a username and password
  • C. It cannot list directories
  • D. It uses separate control and data connections
  • E. It uses TCP for reliability
  • 12. After copying a new IOS image to flash, which command makes the router load it at the next reload?
  • A. boot system flash:filename
  • B. copy flash: startup-config
  • C. config-register 0x2142
  • D. verify /md5

Answers

  • 1. B. An inform is acknowledged; a trap is not.
  • 2. B. Agents listen on 161; 514 is syslog; 69 is TFTP.
  • 3. B, C. v2c communities are clear text; v1 lacks informs; v3 uses users.
  • 4. B. A threshold includes its level and all more severe (lower) levels.
  • 5. B. The format is %FACILITY-SEVERITY-MNEMONIC; ADJCHG is the mnemonic.
  • 6. C. 5 is notifications, 6 informational, 7 debugging.
  • 7. B. terminal monitor enables log display for the current vty session.
  • 8. A, B. The key is named host.domain.
  • 9. B. transport input ssh limits inbound protocols on the lines.
  • 10. B. show ip ssh displays "SSH Enabled - version 2.0"; show ssh lists sessions.
  • 11. A, C. Authentication, TCP and dual connections describe FTP.
  • 12. A. Then save; verify /md5 only checks integrity.
Use ← → to move between sections