Technical Tip: How to configure a host server IP for SNMP user to a managed FortiSwitch

Description

This article describes the workaround to configure an SNMP notification host on a managed FortiSwitch.

Scope

FortiSwitch.

Solution

When FortiSwitch is managed by FortiGate, ‘config switch-controller snmp-user’ is used to set up snmpv3 config on all managed FortiSwitches.

config switch-controller snmp-user 
    edit "Test1" set queries enable 
        set query-port 161 
        set security-level auth-priv 
        set auth-pwd <PASSWORD> 
        set priv-pwd <PASSWORD>
        set auth-proto sha256 
        set priv-proto aes256 
    next 
end

Note that there is no option to set 'notify host' under ‘switch-controller snmp-user’. The user may verify the corresponding configuration in FortiSwitch by using the command ‘show full system snmp user’ in the FortiSwitch CLI.

config system snmp user 
    edit "user1" 
        set events cpu-high mem-low log-full intf-ip ent-conf-change llv sensor-fault sensor-alarm fan-detect psu-status ip-conflict tkmem-hb-oo-sync fsTrapStitch1 fsTrapStitch2 fsTrapStitch3 fsTrapStitch4 fsTrapStitch5 storm-control 
        unset notify-hosts 
        set queries enable 
        set query-port 161 
        set security-level auth-priv 
        set auth-proto sha256 
        set auth-pwd <PASSWORD> 
        set priv-proto aes256 
        set priv-pwd <PASSWORD> 
    next 
end 

Note, no host server IP is available on FortiSwitch configuration for traps to sent. Solution: Push the notification host configuration using custom commands.

config switch-controller custom-command 
    edit "snmpv3host" 
        set command "config system snmp user %0a edit user1 %0a set notify-hosts 1.1.1.1 %0a next %0a end %0a" 
    next 
end 

Here, user1 is used as the SNMP user, and 1.1.1.1 is used as the placeholder SNMP host IP. Assign the configured custom command to the managed FortiSwitch.

config switch-controller managed-switch 
    edit <FortiSwitch>
        config custom-command 
            edit "0" 
                set command-name "snmpv3host" 
            next 
        end 
    end 

The user may verify the corresponding configuration in FortiSwitch by using the command ‘show full system snmp user’ in the FortiSwitch CLI:

config system snmp user 
    edit "user1" 
        set events cpu-high mem-low log-full intf-ip ent-conf-change llv sensor-fault sensor-alarm fan-detect psu-status ip-conflict tkmem-hb-oo-sync fsTrapStitch1 fsTrapStitch2 fsTrapStitch3 fsTrapStitch4 fsTrapStitch5 storm-control 
        set notify-hosts 1.1.1.1 
        set queries enable 
        set query-port 161 
        set security-level auth-priv 
        set auth-proto sha256 
        set auth-pwd <PASSWORD> 
        set priv-proto aes256 
        set priv-pwd <PASSWORD> 
    next 
end