...

You should now be using SNMPv3 to communicate with this device from NMIS8.

Updating NMIS9 to support SHA256 and AES256 including Cisco variants

The history of encryption in SNMPv3 is long and winding and possibly interesting to some people, the reality is that the only consistency with SNMPv3 implementations is the inconsistency in the implementations by different vendors and projects.  Frequently combinations of protocols are not supported (or do not work), so you need to find the matching combinations.

Once you have updated the SNMP libraries NMIS uses for SNMP, you should be able to use the following protocols for SNMPv3.

Authentication Protocols

Privilege Protocols

Update or Install Perl Modules

Crypt::Rijndael module needs to be installed for AES support. This is the command to install Crypt::Rijndael if this module is not already installed and will ensure we have the latest version:

sudo cpanm Crypt::Rijndael --sudo

Net::SNMP module needs to be up to date - currently v6.0.1 - this command will ensure we have the latest version:

sudo cpanm Net::SNMP --sudo

Patch Net::SNMP::Security::USM to support 256 bit and higher encryption

The NMIS development team have added support to the Net::SNMP library using the work done recently by the team and leveraging the work done by Napsty @ https://raw.githubusercontent.com/Napsty/scripts/master/perl-net-snmp-sha2/USM.pm

If you are using NMIS 9.4.3 or earlier you will need to obtain the contrib folder from GitHub @https://github.com/Opmantek/nmis9/tree/nmis9_dev/contrib/perl-net-snmp-256

We will use a patched Net::SNMP::Security::USM, for Net::SNMP v6.0.1, which is backwards compatible with all snmp protocol strings used in the original Net::SNMP::Security::USM module.
All protocol strings are case-insensitive.

Copy the shipped USM.pm from the contrib folder and replace the Net::SNMP v6.0.1 version.

On RedHat 8 based systems

sudo cp /usr/share/perl5/vendor_perl/Net/SNMP/Security/USM.pm /usr/share/perl5/vendor_perl/Net/SNMP/Security/USM.pm.original
sudo cp /usr/local/nmis9/contrib/perl-net-snmp-256/USM.pm /usr/share/perl5/vendor_perl/Net/SNMP/Security/USM.pm

On Debian/Ubuntu based systems

sudo cp /usr/share/perl5/Net/SNMP/Security/USM.pm /usr/share/perl5/Net/SNMP/Security/USM.pm.original
sudo cp /usr/local/nmis9/contrib/perl-net-snmp-256/USM.pm /usr/share/perl5/Net/SNMP/Security/USM.pm

Find where USM.pm is installed

Older Linux versions will have the Perl module somewhere else, the fastest way to find it is to use find.

sudo find /usr -name USM.pm

Restart the NMIS9 Daemon

sudo systemctl restart nmis9d

Update NMIS GUI to show new options

sudo cp /usr/local/nmis9/contrib/perl-net-snmp-256/Table-Nodes.nmis /usr/local/nmis9/conf

Testing SNMPv3 quickly

The contrib folder includes a lightweight SNMP testing tool, which differs from the nmis9/admin/tests.pl tool, in that it does not use net-snmp Linux package at all, it purely exercises the NMIS SNMP libraries.

/usr/local/nmis9/contrib/perl-net-snmp-256/test-snmp.pl node=lab-fortigate

SNMP test results for lab-fortigate:
  Open SNMP session to lab-fortigate
    Auth Protocol: sha, Priv Protocol: aes
  Testing SNMP session
  Performing SNMP get of 1.3.6.1.2.1.1.1.0 and 1.3.6.1.2.1.1.2.0
    sysDescr: lab-fortigate-int
    sysObjectID: 1.3.6.1.4.1.12356.101.1.65

SNMP PASSED

To quickly change NMIS configuration to use a different combination, update the device and commit/apply changes.

Update NMIS node details:

/usr/local/nmis9/admin/node_admin.pl act=set node=lab-fortigate entry.configuration.authprotocol=sha256 entry.configuration.privprotocol=aes256c

Repeat your SNMP test

SNMP test results for lab-fortigate:
  Open SNMP session to lab-fortigate
    Auth Protocol: sha256, Priv Protocol: aes256c
  Testing SNMP session
  Performing SNMP get of 1.3.6.1.2.1.1.1.0 and 1.3.6.1.2.1.1.2.0
    sysDescr: lab-fortigate-int
    sysObjectID: 1.3.6.1.4.1.12356.101.1.65

SNMP PASSED

More on Vendor Support for SHA and AES 256

In testing the NMIS development team found that the implementation of SNMP options was not consistent.

For example on a Fortigate device, the administration GUI allowed setting SHA256 and AES256 but these would not work together, when SHA256 and AES256 Cisco were used, the system was very happy.  Many Cisco devices will support SHA256 but only AES128 (which given the entropy is reasonable "AES-128 would take about 2.61*10^12 years to crack" https://www.ubiqsecurity.com/128bit-or-256bit-encryption-which-to-use/).

NMIS can only support something if the vendor support its.

BTW, at the time of writing (March 2023) net-snmp on Linux does not include support for AES256 by default, nor do the SNAP repos, net-snmp does support AES256, you just need to compile if yourself.

SNMPv3 Error Messages and How to Decode Them

No response from remote host during synchronization

The test-snmp.pl tool would show this:

ERROR: Could not open SNMP session to node lab-fortigate: No response from remote host "lab-fortigate-int.opmantek.net" during synchronization

This means you have the wrong authentication protocol or password, you will need to change them and try again

No response from remote host

The test-snmp.pl tool would show this:

ERROR: Could not retrieve SNMP vars from node lab-fortigate: No response from remote host "lab-fortigate-int.opmantek.net"

This means you have the wrong privilege protocol or password, you will need to change them and try again

The authProtocol is unknown during discovery

The test-snmp.pl tool would show this:

ERROR: Could not open SNMP session to node lab-fortigate: The authProtocol "1.3.6.1.6.3.10.1.1.5" is unknown during discovery

This means the remote SNMP agent in the end device (node) does not know what this authentication protocol is.

Related Topics

• Opmantek Virtual Machine: Implementing SNMPv3 AES256 in the NMIS9 VM for Secure Network Management

...