Managers and agents
SNMP (Simple Network Management Protocol) lets a manager (the monitoring server, NMS) read and change values on an agent (the router or switch):
| Message | Direction | Port | Use |
|---|---|---|---|
| Get / GetNext / GetBulk | Manager → agent | UDP 161 | Read values (walk a whole table) |
| Set | Manager → agent | UDP 161 | Change a value |
| Trap | Agent → manager | UDP 162 | "Something happened" (not acknowledged) |
| Inform | Agent → manager | UDP 162 | Like a trap, but acknowledged (v2c, v3) |
The values live in the MIB (Management Information Base), a tree in which each value has an OID (object identifier) such as 1.3.6.1.2.1.1.5.0, or sysName.0.
Versions
| Version | Security | Notes |
|---|---|---|
| v1 | Community string, sent in clear text | Old |
| v2c | Community string, in clear text | Adds GetBulk and informs; still common |
| v3 | Users with authentication (MD5/SHA) and encryption (DES/AES) | Use this |
v3 has three security levels: noAuthNoPriv (user name only), authNoPriv (authentication), authPriv (authentication and encryption: priv).
In NetLab
▶ R1 R1>enable R1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. R1(config)#snmp-server community NetLabRO RO R1(config)#snmp-server location Server room 2 R1(config)#snmp-server contact noc@example.com R1(config)#snmp-server group MONITOR v3 priv R1(config)#snmp-server user nms MONITOR v3 auth sha Auth!Pass1 priv aes 128 Priv!Pass1 R1(config)#snmp-server host 10.1.1.50 version 2c NetLabRO R1(config)#snmp-server enable traps snmp linkdown linkup R1(config)#end *Mar 1 00:00:10.000: %SYS-5-CONFIG_I: Configured from console by console ▶ NMS student@NMS:~$ snmpget -v2c -c NetLabRO 10.1.1.1 sysName.0 sysLocation.0 SNMPv2-MIB::sysName.0 = STRING: R1 SNMPv2-MIB::sysLocation.0 = STRING: Server room 2 student@NMS:~$ snmpget -v2c -c guess 10.1.1.1 sysName.0 Timeout: No Response from 10.1.1.1. student@NMS:~$ snmpwalk -v3 -u nms -l authPriv -a SHA -A Auth!Pass1 -x AES -X Priv!Pass1 10.1.1.1 system SNMPv2-MIB::sysDescr.0 = STRING: Cisco IOS Software, NetLab Software (NETLAB-UNIVERSALK9-M), Version 15.4(3)M, RELEASE SOFTWARE SNMPv2-MIB::sysObjectID.0 = OID: SNMPv2-SMI::enterprises.9.1.1041 DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (1700) 00:00:17.00 SNMPv2-MIB::sysContact.0 = STRING: noc@example.com SNMPv2-MIB::sysName.0 = STRING: R1 SNMPv2-MIB::sysLocation.0 = STRING: Server room 2 student@NMS:~$ snmpset -v2c -c NetLabRO 10.1.1.1 sysContact.0 s me@example.com Error in packet. Reason: noAccess Failed object: SNMPv2-MIB::sysContact.0
Common mistake: A wrong v2c community gets no answer at all (a timeout), not an error: the agent just ignores it. And
ROcommunities can'tset: that needsRW(rarely a good idea).
Tip: Lock SNMP down with an ACL:
snmp-server community NetLabRO RO 10only answers sources that standard ACL 10 permits.