SNMP
SNMPV1/V2 Overview
SNMP：As the abbreviation of Simple Network Management Protocol, SNMP has been a network management standard (RFC1157) since the August, 1988. So far, the SNMP becomes the actual network management standard for the support from many manufacturers. It is applicable to the situation of interconnecting multiple systems from different manufacturers. Administrators can use the SNMP protocol to query information, configure network, locate failure and plan capacity for the nodes on the network. Network supervision and administration are the basic function of the SNMP protocol.
SNMP versions:
SNMPv1 ：The first formal version of the Simple Network Management Protocol, which is defined in RFC1157
SNMPv2C： Community-based Administrative Framework for SNMPv2, an experimental Internet protocol defined in RFC1901.
SNMPv3： Offers the following security features by authenticating and encrypting packets:
1. Ensure that the data are not tampered during transmission；
2. Ensure that the data come from a valid data source；
3. Encrypt packets to ensure the data confidentiality；
Both the SNMPv1 and SNMPv2C use a community-based security framework. They restrict administrator’s operations on the MIB by defining the host IP addresses and community string. With the Get Bulk retrieval mechanism, SNMPv2C sends more detailed error information type to the management station. Get Bulk allows you to obtain all the information or a great volume of data from the table at a time, and thus reducing the times of request and response. Moreover, SNMPv2C improves the capability of handing errors, including expanding error codes to distinguish different kinds of errors, which are represented by one error code in SNMPv1. Now, error types can be distinguished by error codes. Since there may be the management workstations supporting SNMPv1 and SNMPv2C in a network, the SNMP agent must be able to recognize both SNMPv1 and SNMPv2C messages, and return the corresponding version of messages.
I. Requirements
1. Only SNMP network manager (IP:192.168.1.2/24) can access switch SNMP service with community string “ruijie”
2. SNMP agent on switch sends SNMP trap to SNMP manager actively
3. SNMP manager can get basic information of switch —location, contact method and chassis id
II. Network Topology
III. Configuration Tips
1. Set Read-Only community string and Read-Write community string on switch independently
2. Define ACL to allow authorized SNMP manager to access SNMP agent of switch only
3. Enable SNMP trap
4. Configure SNMP manager
IV. Configuration Steps
1. Define an access-list named “abc” and an entry to permit IP address of SNMP manager
Ruijie(config)#ip access-list standard abc
Ruijie(config-std-nacl)#permit host 192.168.1.2
Ruijie(config-std-nacl)#exit
2. Set read-write community string to “ruijie” and read-only community string to “public” , then associate both community strings with ACL to allow only the SNMP manager to access SNMP agent of switch only
Ruijie(config)#snmp-server community ruijie rw abc
Ruijie(config)#snmp-server community public ro abc
3. SNMP agent on switch actively sends trap to SNMP network manager
Ruijie(config)#snmp-server host 192.168.1.2 traps ruijie ——>by default , SNMP trap version is version 1
Ruijie(config)#snmp-server host 1.1.1.1 version 2c ruijie ——>set SNMP trap version to version 2c
4. Enable trap feature
Ruijie(config)#snmp-server enable traps
5. Set SNMP optional parameters
Set location
Ruijie(config)#snmp-server location fuzhou
Set contact method
Ruijie(config)#snmp-server contact ruijie.com.cn
Set chassis-id
Ruijie(config)#snmp-server chassis-id 1234567890
6. Assign a management IP address to SVI 1
Ruijie(config)#interface vlan 1
Ruijie(config-if-VLAN 1)#ip address 192.168.1.1 255.255.255.0
7. Save configuration
Ruijie(config-if-VLAN 1)#end
Ruijie#wr
V. Verification
1. This example shows how to verify SNMP agent status
Following example provides how to disable SNMP agent if snmp agent issue leads to heavy load of CPU :
Ruijie(config)#no enable service snmp-agent
2. This examples shows how to display SNMP host information
3. This example shows how to access the SNMP agent in a SNMP manager using “Mib-Browser”
4. Other SNMP manager except for 192.168.1.2 cannot access SNMP agent at the same time.
SNMPV3
I. Requirements
1) The SNMP manager can access the SNMP agent on switch by applying user-based security model. The user name is “admin”, authentication mode is MD5, authentication key is “ruijie”, encryption algorithm is DES56, and the encryption key is “123”
2) User “admin” can read the MIB objects under System (1.3.6.1.2.1.1) node, and can only write MIB objects under SysContact (1.3.6.1.2.1.1.4.0) node.
3) The switch can actively send authentication and encryption messages to the SNMP manager
II. Network Topology
III. Configuration Tips
1. Create MIB view and specify the included or excluded MIB objects.
2. Create SNMP group and set the version to “v3”; specify the security level of this group, and configure the read-write permission of the view corresponding to this group.
3. Create user name and associate the corresponding SNMP group name in order to further configure the user's permission to access MIB objects; meanwhile, configure the version number to “v3” and the corresponding authentication mode, authentication key, encryption algorithm and encryption key.
4. Configure the address of SNMP manager, configure the version “3” and configure the security level to be adopted.
IV. Configuration Steps
Configuring switch：
Ruijie#configure terminal
Ruijie(config)#snmp-server view view1 1.3.6.1.2.1.1 include ——> Create a MIB view of “view1” and include the MIB object of 1.3.6.1.2.1.1
Ruijie(config)#snmp-server view view2 1.3.6.1.2.1.1.4.0 include ——> Create a MIB view of “view2” and include the MIB object of 1.3.6.1.2.1.1.4.0
Ruijie(config)#snmp-server group group1 v3 priv read view1 write view2 ——>Create a group named “g1” ,using SNMPv3 ; configure security level to “priv” ,and can read “view1” and write “view2”
Ruijie(config)#snmp-server user admin group1 v3 auth md5 ruijie priv des56 ruijie123 ——>Create a user named “admin”, which belongs to group “group1”; using SNMPv3 and authentication mode is “md5”, authentication key is “ruijie”, encryption mode is “DES56” and encryption key is “123”.
Ruijie(config)#snmp-server host 192.168.1.2 traps version 3 priv admin ——>Configure the SNMP server address as 192.168.1.2 , using SNMPv3,then configure security level to “priv” and associate the corresponding user name of “admin”
Ruijie(config)#snmp-server enable traps ——>Enable the Agent to actively send traps to NMS
Ruijie(config)#interface vlan 1
Ruijie(config-if-VLAN 1)#ip address 192.168.1.1 255.255.255.0
Ruijie(config-if-VLAN 1)#end
Set SNMP optional parameters
Ruijie(config)#snmp-server location fuzhou
Ruijie(config)#snmp-server contact ruijie.com.cn
Ruijie(config)#snmp-server chassis-id 1234567890
Note： If you don't create a new SNMP view, Ruijie switch uses the default SNMP view named “default” ,including MIB object of 1
Minimun SNMPv3 configuration example:
snmp-server group group1 v3 priv read default write default
snmp-server user admin group1 v3 auth md5 ruijie priv des56 ruijie123
snmp-server host 192.168.1.2 traps version 3 priv admin
snmp-server enable traps
V. Verification
1. This example shows how to verify SNMP agent status
Following example provides how to disable SNMP agent if snmp agent issue leads to heavy load of CPU :
Ruijie(config)#no enable service snmp-agent
2. Following examples show how to display snmp view, snmp group and snmp user individually
