Password Config Catchall setting

[MattAnderson]

Hello, I sometimes use a catchall for the password config instead of having to add in settings for multiple devices.  An examaple would be snmpV2cNMP or snmpV2c:CISCODEV.  One problem with this is if you use the web to update settings this can get clobbered (enhancement request?).  We use a standard password and community string so having to add them in for each device is cumbersome. 

I'm trying to use two catchalls for the same config, snmpV2c:CISCODEV and snmpv3:CISCODEV & snmpv3encrypt:CISCODEV.  This does not appear to work and it will only use one of them.  I have over a thousand devices that are using a mix of v2 and v3.  Is there a way to script this?  I have used ircnfutl to export / import but not sure if there is a way to update the password config.

Thanks

[SCOTT_BALDWIN]

Hello @MattAnderson,

The CISCODEV configuration only being able to use one version of SNMP (SNMP v2c or v3) is a limitation of the configuration.

Possible options:

1. Use SNMP v2c for the CISCODEV configuration in one Monitoring Node, and use a second Monitoring Node with the CISCODEV configuration set to use SNMP v3.
   • Each CISCODEV configuration will have a separate list of devices, but at least the PASSWORDS would be simplified.
2. Duplicate the CISCODEV collector (and use a unique name such as CISCODEV2).
   • Set the CISCODEV configuration to to use one version of SNMP and the other CISCODEV2 configuration to use the other version of SNMP.
   • Duplicating a configuration and collector is very complex and should involve Professional Services.

Thank you,

Scott Baldwin

[MattAnderson]

Thanks Scott!  Those are both workable options I can explore.  Is there a way to script updating the password config?  I think the answer is no because of the encrypted fields but just wanted to verify.  

[SCOTT_BALDWIN · Accepted solution]

Hello @MattAnderson,

I've had success using ircnfutl list_conf for a working PASSWORD configuration, then using ircnfutl update_conf to put the original PASSWORD configuration back into Prognosis, but I've not not tried using ircnfutl to add more entries into the PASSWORDS configuration.

I expect encryption prevents adding new rows from ircnfutl list_conf output, then using ircnfutl update_conf to push the modifications back in. It can be tried, but I don't expect it to work.

Thank you,

Scott Baldwin

[Scott_Clement · Accepted solution]

Hi @MattAnderson,

If you need a to encrypt a password in the same format the PASSWORDS configuration uses, you can use irpqlcli.

The following example would be executed from a command shell spawned in the server\configuration directory:

..\x64\irpqlcli "select EncryptPassword('<mypassword>')"

You just need to substitute <mypassword> with the actual password you're encrypting.

Hope this helps!

Regards,

Scott

[MattAnderson]

Does this encryption need to run per system or can I copy the encrypted password and use on another system?  

[Scott_Clement · Accepted solution]

Hi Matt,

Great question! I wasn't sure myself but, after running a couple of test using two 11.9 systems, it does appear they're system sepecific. That would necessitate having to run any script you create on each node you're updating the passwords for.

Regards,

Scott