IOS-XE – SNMPv3

Sets up SNMPv3 access with either read/write enforcement or read-only discovery, plus MAC address notifications.

FortiNAC · Not specifiedCisco IOS-XE · Not specifiedSNMP Integration10 min readExample · Not lab validated

Demo guide — not a tested configuration

This example demonstrates the guide format. Versions and procedures await owner lab review. Do not apply it to a production network. No verified date or firmware compatibility is claimed.

On this page

Before you begin

Confirm each prerequisite before planning changes. Checklist progress is kept for this visit and resets when you reload.

Prerequisites

0/4 checked

Confirm the exact device model and firmware; no validated release is specified in this source.Have administrative access, a recovery path and the FortiNAC management address available.Prepare the SNMP user, authentication/privacy credentials and required management reachability.Choose global or per-interface linkUp/linkDown suppression for the intended scope; retain required MAC-notification events.

Overview

Sets up SNMPv3 access with either read/write enforcement or read-only discovery, plus MAC address notifications.

Before applying this configuration

Replace all placeholders and confirm command support on the exact model and firmware. Use least-privilege credentials and restrict management sources. These source-derived templates have not been independently lab-tested.

This is a device configuration baseline. Existing VLANs, routing and the FortiNAC policy design are assumed; adapt placeholders and select the intended interfaces.

Choose either Read/write enforcement or Read-only discovery, then apply its per-port example. Each option includes its own ACL, SNMPv3 user, trap receivers and global MAC-notification settings; neither depends on the other. Omit the FNAC_2_IP lines when there is no secondary FortiNAC server.

Read/write enforcement

Use this device configuration for read/write enforcement. Replace the example values before applying it.

CLI / illustrative reference

conf t
ip access-list standard FORTINAC-SNMP
 permit <FNAC_IP>
 permit <FNAC_2_IP>
exit
snmp-server view fortinac-snmp-rw iso included
snmp-server view fortinac-snmp-rw system included
snmp-server view fortinac-snmp-rw interfaces included
snmp-server group fortinac-group v3 priv read fortinac-snmp-rw write fortinac-snmp-rw notify fortinac-snmp-rw access FORTINAC-SNMP
snmp-server group fortinac-group v3 priv context vlan- match prefix read fortinac-snmp-rw write fortinac-snmp-rw access FORTINAC-SNMP
snmp-server user fortinac-rw fortinac-group v3 auth sha <SNMP_AUTH_PASSWORD> priv aes 128 <SNMP_PRIV_PASSWORD> access FORTINAC-SNMP
snmp-server host <FNAC_IP> traps version 3 priv fortinac-rw mac-notification
snmp-server host <FNAC_2_IP> traps version 3 priv fortinac-rw mac-notification
snmp-server enable traps mac-notification change move threshold
mac address-table notification change
mac address-table notification mac-move
mac address-table notification threshold
end
write memory

Per-port example — read/write

After the matching global configuration above, enable MAC added/removed notifications on each intended Layer 2 access port. Repeat for additional ports. SNMP read-only/read-write permissions apply to the FortiNAC user; the port notification commands are the same for both options.

CLI / illustrative reference

configure terminal
interface <ACCESS_INTERFACE>
 snmp trap mac-notification change added
 snmp trap mac-notification change removed
exit
end
write memory

Chapter verification — Read/write port notifications

0/1 checked

A controlled endpoint attach/detach on the configured port produces MAC notifications that FortiNAC receives and associates with the correct port.

Read-only discovery

Use this device configuration for read-only discovery. Replace the example values before applying it.

CLI / illustrative reference

configure terminal
ip access-list standard FORTINAC-SNMP
 permit <FNAC_IP>
 permit <FNAC_2_IP>
exit
snmp-server view fortinac-snmp-ro iso included
snmp-server group fortinac-ro-group v3 priv read fortinac-snmp-ro notify fortinac-snmp-ro access FORTINAC-SNMP
snmp-server group fortinac-ro-group v3 priv context vlan- match prefix read fortinac-snmp-ro access FORTINAC-SNMP
snmp-server user fortinac-ro fortinac-ro-group v3 auth sha <SNMP_AUTH_PASSWORD> priv aes 128 <SNMP_PRIV_PASSWORD> access FORTINAC-SNMP
snmp-server host <FNAC_IP> traps version 3 priv fortinac-ro mac-notification
snmp-server host <FNAC_2_IP> traps version 3 priv fortinac-ro mac-notification
snmp-server enable traps mac-notification change move threshold
mac address-table notification change
mac address-table notification mac-move
mac address-table notification threshold
end
write memory

Chapter verification — Configuration

0/2 checked

The intended read-only or read/write permission is selected.The configured SNMP credentials, security mode and FortiNAC destinations match.

Per-port example — read-only

CLI / illustrative reference

configure terminal
interface <ACCESS_INTERFACE>
 snmp trap mac-notification change added
 snmp trap mac-notification change removed
exit
end
write memory

Chapter verification — Read-only port notifications

0/1 checked

A controlled endpoint attach/detach on the configured port produces MAC notifications that FortiNAC receives and associates with the correct port.

Required — suppress linkUp/linkDown traps

Mandatory — disable linkUp/linkDown traps

Disabling linkUp/linkDown SNMP traps is mandatory for this FortiNAC integration. Choose either Global or Per interface below; both methods are not required. Keep the MAC-notification traps required for endpoint tracking enabled.

After the core SNMP configuration, choose one method: Global for all interfaces within the stated scope, or Per interface for the ports covered by this integration. Apply the chosen method and verify the result; you do not need to apply both.

Monitoring tools and interface exceptions

If monitoring tools or other services rely on linkUp/linkDown traps, preserve them on the specific interfaces they monitor. IOS/IOS-XE requires both global and interface trap enablement; enabling an interface cannot override a global disable. When monitoring exceptions are needed, choose Per interface suppression, keep global link-trap generation enabled, and enable notifications on the required monitoring interfaces. Verify delivery to those services and suppression on the intended FortiNAC ports.

Global

Disable linkUp/linkDown traps switch-wide. The IOS/IOS-XE global command includes the snmp keyword.

CLI / illustrative reference

configure terminal
no snmp-server enable traps snmp linkup linkdown
end
write memory

Per interface

Instead, disable link-status traps on the selected interface. Repeat for each interface covered by the integration, or use interface range <PORT_RANGE> where supported. Leave the global setting unchanged when choosing this method.

CLI / illustrative reference

configure terminal
interface <INTERFACE>
 no snmp trap link-status
exit
end
write memory

Chapter verification — Required trap suppression

0/4 checked

The chosen Global OR Per interface method suppresses linkUp/linkDown notifications for the interfaces covered by this integration.A controlled link change on a spare test port produces no linkUp/linkDown notification at FortiNAC.Required MAC-notification events still reach FortiNAC after link-status suppression.Any monitoring exceptions are limited to the required interfaces, and dependent tools or services still receive their link notifications.

Considerations

Both options create their own ACL and notification configuration. Select read-only for discovery or read/write when the intended FortiNAC action requires it. On L3 switches, select a stable trap source with snmp-server source-interface traps <SOURCE_INTERFACE> where supported. Apply the mandatory linkUp/linkDown suppression below the core configuration while retaining MAC notifications.

References

Original configuration source (Notion; access may be required) ↗

The supplied snippets are source-derived, not lab-validated. Confirm exact platform and firmware support before applying them. Original Notion pages may require access; their contents were not independently retrieved.

Cisco — SNMP trap controls and global/per-interface contexts ↗

Cisco IOS-XE — global and per-interface MAC notification configuration ↗

Verify the result

Use observed results to decide whether the intended outcome has been achieved.

Expected result

Sets up SNMPv3 access with either read/write enforcement or read-only discovery, plus MAC address notifications.

Final verification

0/4 checked

FortiNAC can query the device using the selected SNMP credentials.A controlled test event reaches FortiNAC when traps are configured.Required discovery and any intended write action succeed before wider use.The chosen global or per-interface method suppresses linkUp/linkDown traps for the intended scope while required MAC notifications remain enabled.

If it isn’t working

If polling or traps fail, check reachability, source restrictions, SNMP version, credentials and destination settings. Check the permissions required by the intended operation.

Change one variable at a time

Record what the system received and applied, along with the relevant logs and timestamps. Keep rollback access available.

Video walkthrough

No video attached

The written guide stands on its own. A companion video can be added after the guide is validated.

Browse all guidesChecklist progress resets on reload

IOS-XE – SNMPv3

Before you begin

1Overview

2Read/write enforcement

3Per-port example — read/write

4Read-only discovery

5Per-port example — read-only

6Required — suppress linkUp/linkDown traps

Global

Per interface

7Considerations

8References

Verify the result

If it isn’t working

Video walkthrough

Overview

Read/write enforcement

Per-port example — read/write

Read-only discovery

Per-port example — read-only

Required — suppress linkUp/linkDown traps

Considerations

References