Cisco ASA SNMP & Syslog Configuration

Cisco ASABeginner

Configure SNMP v2c/v3 and syslog on a Cisco ASA for monitoring and centralized logging with NMS and SIEM integration.

What is it?

SNMP (Simple Network Management Protocol) and Syslog are the two foundational monitoring protocols for network devices. SNMP allows a Network Management System (NMS) like SolarWinds, PRTG, or LibreNMS to poll the ASA for metrics (CPU, memory, interface stats, connection counts) and receive traps when events occur. Syslog sends real-time log messages to a centralized SIEM (Splunk, QRadar, Graylog) for security monitoring and compliance. SNMP v3 is strongly preferred over v2c — it provides authentication and encryption.

✓ When to use

·Always — every production ASA should have syslog configured from Day 0
·SNMP v3 for integration with NMS tools (SolarWinds, PRTG, Zabbix, LibreNMS)
·Syslog to a SIEM for security monitoring, incident response, and compliance (PCI-DSS, SOC 2)
·SNMP traps for real-time alerting on interface down, high CPU, VPN tunnel failures

✗ When NOT to use

·SNMP v1/v2c in security-sensitive environments — community strings are sent in cleartext
·Syslog over UDP to a remote SIEM across untrusted networks — use TCP syslog or TLS syslog instead

How it compares

vs SNMP v2c vs v3v2c uses a plaintext community string for authentication — anyone who intercepts it can query your device. v3 uses SHA authentication and AES encryption. Always use v3 for new deployments.

vs Syslog vs SNMP TrapsSyslog sends detailed text log messages continuously. SNMP traps send structured alerts for specific events. Use both: syslog for detailed audit trail, SNMP traps for real-time alerting.

Prerequisites

→Management interface must be configured and reachable from the NMS/SIEM server
→NMS server IP must be known before configuring SNMP host entries
→Syslog server must be listening on UDP/TCP 514
→For SNMP v3, the user must be created before adding them to a host entry

Config Generator

Management Interface *

Syslog Server IP *

Syslog Severity Level

SNMP Version

SNMP v2c Community

Only used if SNMP v2c selected

SNMP v3 Username

SNMP v3 Auth Password

SNMP v3 Priv Password

NMS / SNMP Manager IP *

SNMP Location

SNMP Contact

Verification commands

show logging

Verify syslog is enabled and shows the correct server and trap level

Expected: Should show 'Logging: enabled', trap level, and the syslog server IP with interface

show snmp-server

Verify SNMP configuration — community/user, host, location, contact

Expected: Shows full SNMP config including configured hosts and enabled traps

show snmp-server statistics

Verify SNMP packets are being sent and received

Expected: Incrementing 'SNMP packets output' counter indicates the NMS is polling successfully

Debug commands

debug snmp trace

Debug SNMP polling — shows each OID requested by the NMS

⚠ Verbose. Use only for short periods. Run 'no debug all' after.

Common mistakes & fixes

⚡ NMS not receiving SNMP data

Cause: Wrong community string, wrong version, or management ACL blocking UDP 161

Fix: Verify 'snmp-server host' entry matches the NMS IP. Check management interface ACL permits UDP 161 from the NMS.

⚡ SNMP v3 authentication failure

Cause: User created with wrong auth/priv passwords, or auth protocol mismatch

Fix: Delete and recreate the user: 'no snmp-server user <user> <group> v3'. Recreate with correct passwords. Verify NMS uses the same auth/priv protocols.

⚡ Syslog messages not appearing in SIEM

Cause: Wrong syslog server IP, wrong interface, or firewall blocking UDP 514

Fix: Check 'show logging' for the server entry. Test connectivity: 'ping management <syslog-ip>'. Verify SIEM is listening on UDP 514.