DENIS

Guide 3 of 3 · about 15 minutes

See switch ports and cabling with SNMP on managed switches

If your managed switches answer SNMP, DENIS can show which port each device is plugged into and how the switches are cabled together. It only reads, unless you separately allow port actions.

What you need

  • A managed switch with SNMP, reachable from the DENIS server on UDP 161.
  • Permission to add an SNMP user or community on the switch.

What DENIS reads, and which switches were tested

Every few minutes DENIS reads the standard tables: the system name, the ports (name, label, link, speed), LLDP neighbours and the forwarding table that says which hardware address was learned on which port. On Cisco IOS it also reads trunk modes and the VLAN list, and the forwarding table per VLAN. Reading never changes the switch.

  • Cisco Catalyst 2960-X (IOS 15.2(7)E4), SNMPv2c and SNMPv3: tested on real equipment.
  • D-Link DGS-1100-08V2: partly tested. Ports can be read, but this model has no forwarding table or LLDP over SNMP, so devices behind it are placed by hand.
  • Since 4.3 any managed switch with standard SNMP can be read; other makes use the same standard tables but have not been tested on real hardware. Reports are welcome.

Steps

  1. Create a read-only SNMP user on the switch

    Use SNMPv3 where you can, and allow only the DENIS server’s address. This is the read-only part of the configuration that was tested on a Catalyst 2960-X (DENIS server 192.0.2.10; replace the user name, passwords and address). In SNMPv2c, use a long random read-only community instead, limited by the same access list, and treat it as a password: it travels unencrypted.

    lldp run
ip access-list standard DENIS-SNMP
 permit 192.0.2.10
 deny any log
snmp-server view DENIS-READ iso included
snmp-server group DENIS-RO v3 priv read DENIS-READ access DENIS-SNMP
snmp-server group DENIS-RO v3 priv context vlan- match prefix read DENIS-READ access DENIS-SNMP
snmp-server user denis-ro DENIS-RO v3 auth sha <auth password> priv aes 128 <privacy password> access DENIS-SNMP

  2. Add the switch in DENIS

    Network → Equipment → + Add a switch: a name, the switch address, the SNMP version and the read user (security level authPriv, SHA-1, AES-128 for the configuration above) or the read community. Credentials are stored encrypted and never shown again. Press Read now: it reports how many ports, neighbours and hardware addresses were read, or why not.

  3. Look at the result

    Network → Map shows the switches and cables, and Network → Setup walks through the remaining steps; each cable says whether the equipment confirmed it, it is a best guess from the forwarding tables, or it was set by hand. A device’s own panel says which port it is plugged into. Polling runs every five minutes by default.

  4. Optional: allow port actions

    Switching a port off, or moving it to a quarantine VLAN you built, needs a separate write user or community, a switch in Settings → Response policy and an administrator’s confirmation for every action. Both actions were validated on the tested Catalyst 2960-X. On other switches they are Experimental (generic SNMP control, new in 4.3, tested only on simulators). The supported infrastructure page has the details.

Troubleshooting

  • “No answer from the device”Check that SNMP is on, the user or community and its access list, and that UDP 161 is reachable from the DENIS server.
  • Some VLANs are missing on a Cisco switchCisco switches are read per VLAN; the SNMPv3 configuration above includes the “context vlan-” line for that. The SNMP documentation has a troubleshooting table. DENIS does not act on ports whose VLAN was not read, and says so.
  • Devices are not placed on a portThe switch may not expose its forwarding table over SNMP (as on the D-Link above). Place the device by hand on the map.

Known limitations

  • Only the Cisco Catalyst 2960-X has been tested end to end; other switches are expected to work through the standard tables but are untested.
  • Since 4.3 any managed switch with standard SNMP can be read; port off and quarantine VLAN on such switches are Experimental, off by default, need a write test, and were tested only on simulators.

In the documentation

Something did not work as described? Tell us on GitHub or in the community.