Cisco IOS/IOS-XE

Purpose

This integration collects running configuration, interface, VLAN and CDP neighbor data from Cisco IOS and IOS-XE switches and routers using SNMPv3 for polling and SSH for configuration capture.

Requirements

• SNMPv3 enabled on the device with an authPriv user
• SSH (not Telnet) enabled for configuration backup
• A read-only, non-privileged (or privilege-level 1 with limited show commands) account for SSH

Permissions

• SNMPv3 user with authPriv (SHA + AES) for polling interface, CPU and inventory data
• SSH account restricted to read-only show commands for configuration capture (privilege level 1 with an authorization view, or a dedicated read-only TACACS+ role)

Setup

1. 1
   Configure SNMPv3

   Create an SNMPv3 group and user with authPriv, matching the credential profile in AssurIQ's Credential Vault.
2. 2
   Enable SSH

   Confirm SSH version 2 is enabled and Telnet is disabled.
3. 3
   Create a read-only CLI account

   Create a local or TACACS+ account scoped to read-only show commands for config backup.
4. 4
   Add the device to AssurIQ

   Add the device's management IP and credentials under Network > Configuration.
5. 5
   Verify polling and backup

   Confirm SNMP polling succeeds and a configuration backup is captured on schedule.

Verification

• Device appears in Network Map with correct model and IOS version
• Configuration Backups shows a successful capture with a diff-able baseline
• Interface and PoE data populates for switches

Data collected

• Running configuration snapshots and diffs
• Interface state, errors, utilization and PoE budget
• VLAN, trunk and CDP neighbor data
• CPU, memory and environmental SNMP metrics

Security model

SNMPv3 authPriv encrypts and authenticates all polling traffic. The SSH account used for configuration capture is restricted to read-only commands and cannot modify running configuration. Credentials are stored in the Credential Vault, never in device configuration.

Common errors

• AIQ-SNMP-002SNMP authentication failed
  The credential profile was rejected by the device (bad community string or SNMPv3 auth/priv mismatch).
• AIQ-CRD-001Credentials failing
  Stored credentials were rejected by one or more targets.

Troubleshooting

• If configuration backup fails but SNMP polling works, confirm SSH is enabled and the account has show running-config access.
• If CDP neighbors are missing, confirm CDP is enabled on the relevant interfaces.

Disconnect

1. Remove the device from AssurIQ Network > Configuration.
2. Remove the SNMPv3 user and read-only CLI account from the device.