Agentless Cisco inventory over SSH, with an SNMP v2c/v3 fallback

The problem

An accurate component inventory is the first control most frameworks ask for, and often rebuilt by hand shortly before a review. For network equipment the facts live on the devices: chassis and module serials, software versions, license state and enabled management services. Getting them out usually means an installed collector or a spreadsheet kept from memory.

Three downstream systems want these facts in different shapes. A vendor support cloud tracks coverage and end of life per serial, so a chassis with two power supplies is three assets. A CMDB wants one item per device. An automation platform wants a device-import list. Hand-built exports drift apart.

What was built

One PowerShell script produces all three exports from one collection pass. Nothing is installed on the devices and nothing runs as a service.

• Targets come inline or from a .txt, .csv or .xlsx file. Addresses, hostnames, CIDR blocks and ranges are expanded and de-duplicated, capped at 4,096 hosts by default.
• SSH is the primary method. Over an interactive session the script disables paging, then runs a fixed set of show commands: version, inventory, three license views, a filtered view of the running configuration (service, HTTP, SSH, SNMP, NTP, AAA, logging, local user and line settings) and a CPU process summary. Its parsers include branches for IOS, IOS-XE, NX-OS and ASA output.
• SNMP is the fallback when SSH fails, in v2c or v3. It returns system description, name and uptime plus the ENTITY-MIB model, serial and software tables, but no licensing or services.
• Exports are written to a timestamped folder:

Output	Shape
Vendor support cloud CSV	One row per serial: chassis and each module, with chassis serial, software, license mode and UDI
CMDB import	JSON for an import-set or table API, plus CSV, one configuration item per device
Network automation platform CSV	Device-import columns: host, primary address, vendor, model, version, serial
Full JSON and raw CLI	The parsed model and the raw output per device, for re-parsing and review

Design decisions

No required dependencies. The SNMP client is written into the script: BER encoding and decoding over raw UDP. Spreadsheets are read by opening the .xlsx archive. An SSH module is used when present because it handles enable mode and paging in an interactive shell. If absent, the script offers to install it from the public gallery for the current user (default yes); declining falls back to the operating system’s client, one command per connection.

SNMPv3 implemented from the specification. The v3 path performs per-host engine discovery, the RFC 3414 SHA-1 password-to-key derivation and key localization, HMAC-SHA-1-96 message authentication, and AES-128 CFB privacy, in authPriv or authNoPriv. On a report, typically a clock mismatch, it resynchronizes engine time and retries once. MD5 and DES were left out deliberately.

Credentials held only in memory. SSH credentials, the optional enable secret, the v2c community and the v3 passphrases are prompted at run time as secure strings. There is no configuration file, and the script never saves the prompted values. The collected configuration lines can contain community strings and password hashes, so the output is handled as sensitive.

Per serial for support coverage, per device for the CMDB. Entitlement and end of life follow the serial, so a module without its own row has no visible coverage. Configuration items stay one per device.

Raw output kept, and treated as sensitive. Raw per-device text holds serials and configuration fragments, including local user and SNMP community lines, so the output folder is excluded from version control.

Evidence and limits

An offline self-test needs no devices. All 27 checks pass under PowerShell 7. They cover:

• version, inventory and license parsing, including empty input;
• device-record assembly, and a clean record for an unreachable host;
• all three exporters, including one row per serial in the support cloud file;
• native .xlsx target import;
• the RFC 3414 SHA vectors for the password-derived and localized keys;
• an AES-128 CFB round trip on an unaligned payload, and a full authPriv message built, encrypted, decrypted and parsed.

Limits:

• It has never been run against a live network. Parsers are tested against one hand-written IOS-XE sample, not against real devices or the other three families.
• Host keys are accepted without verification, for unattended sweeps; recurring use would need pinned keys.
• SNMPv3 responses are decrypted, but their authentication codes are not checked. Requests are authenticated; responses are trusted.
• Some paths have no test: both SSH collection paths, SNMPv3 engine discovery and the report retry, the v2c request, the SNMP table walk, SNMP record assembly and target expansion.
• The documentation claims Windows PowerShell 5.1 support, but the file does not parse there (non-ASCII characters, no byte-order mark). It runs under PowerShell 7.
• The native SSH fallback cannot enter enable mode and relies on key authentication.
• The support cloud CSV is not a vendor seed template; matching one exactly means changing one export function.

Where it applies

For an organization assembling an authorization package, the component inventory is a control in its own right (CM-8) and a reference other controls depend on. Collecting it from the devices on demand, with raw output alongside, gives a reviewer something checkable. The enabled-services view is a starting point for least-functionality review (CM-7).

For a manufacturing supplier, the same pass supports the component inventory IEC 62443 and NIST 800-171 call for, and the inventory questions in customer security questionnaires. The per-serial export is the shape a vendor support portal needs to report coverage and end of life for every module, not just the chassis. An agentless collector that runs only read-only commands suits networks where adding software to production equipment needs its own approval.

For a fractional security lead, this is first-month work: establish what network equipment is in place, in formats existing tools accept, without buying a platform.

Independent work by Wade Blackwell. Each write-up is written from scratch for this site, without client, employer or personal data. Names, hostnames, addresses and configuration detail are left out on purpose.