ITC/3AV WIKI

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
**SNMP**

**SNMPV1/V2
Overview**

SNMP：As the abbreviation of Simple Network Management Protocol, SNMP has been a network management standard (RFC1157) since the August, 1988. So far, the SNMP becomes the actual network management standard for the support from many manufacturers. It is applicable to the situation of interconnecting multiple systems from different manufacturers. Administrators can use the SNMP protocol to query information, configure network, locate failure and plan capacity for the nodes on the network. Network supervision and administration are the basic function of the SNMP protocol.

SNMP versions:

SNMPv1 ：The first formal version of the Simple Network Management Protocol, which is defined in RFC1157

SNMPv2C： Community-based Administrative Framework for SNMPv2, an experimental Internet protocol defined in RFC1901.

SNMPv3： Offers the following security features by authenticating and encrypting packets:

1. Ensure that the data are not tampered during transmission；

2. Ensure that the data come from a valid data source；

3. Encrypt packets to ensure the data confidentiality；

{{:ruijie:switch:image023.png?400|}}

Both the SNMPv1 and SNMPv2C use a community-based security framework. They restrict administrator’s operations on the MIB by defining the host IP addresses and community string. With the Get Bulk retrieval mechanism, SNMPv2C sends more detailed error information type to the management station. Get Bulk allows you to obtain all the information or a great volume of data from the table at a time, and thus reducing the times of request and response. Moreover, SNMPv2C improves the capability of handing errors, including expanding error codes to distinguish different kinds of errors, which are represented by one error code in SNMPv1. Now, error types can be distinguished by error codes. Since there may be the management workstations supporting SNMPv1 and SNMPv2C in a network, the SNMP agent must be able to recognize both SNMPv1 and SNMPv2C messages, and return the corresponding version of messages.

 

**I. Requirements**

1. Only SNMP network manager (IP:192.168.1.2/24) can access switch SNMP service with community string "ruijie"

2. SNMP agent on switch sends SNMP trap to SNMP manager actively

3. SNMP manager can get basic information of switch ---location, contact method and chassis id

 

**II. Network Topology**

{{:ruijie:switch:image024.png?400|}}

**III. Configuration Tips**

1. Set Read-Only community string and Read-Write community string on switch independently

2. Define ACL to allow authorized SNMP manager to access SNMP agent of switch only

3. Enable SNMP trap

4. Configure SNMP manager

 

**IV. Configuration Steps**

1.      Define an access-list named "abc" and an entry to permit IP address of SNMP manager

Ruijie(config)#ip access-list standard abc

Ruijie(config-std-nacl)#permit host 192.168.1.2 

Ruijie(config-std-nacl)#exit

 

2.      Set read-write community string to "ruijie" and read-only community string to "public" , then associate both community strings with ACL to allow only the SNMP manager to access SNMP agent  of switch only

Ruijie(config)#snmp-server community ruijie rw abc

Ruijie(config)#snmp-server community public ro abc   

 

3.      SNMP agent  on switch actively sends trap to SNMP network manager

Ruijie(config)#snmp-server host 192.168.1.2 traps ruijie         ------>by default , SNMP trap version is version 1

Ruijie(config)#snmp-server host 1.1.1.1 version 2c ruijie        ------>set SNMP trap version to version 2c

 

4.      Enable trap feature

Ruijie(config)#snmp-server enable traps 

 

5.      Set SNMP optional parameters

Set location

Ruijie(config)#snmp-server location fuzhou

 

 Set contact method

Ruijie(config)#snmp-server contact ruijie.com.cn

 

 Set chassis-id

Ruijie(config)#snmp-server chassis-id 1234567890

 

6.      Assign a management IP address to SVI 1

Ruijie(config)#interface vlan 1

Ruijie(config-if-VLAN 1)#ip address 192.168.1.1 255.255.255.0

 

7.      Save configuration

Ruijie(config-if-VLAN 1)#end

Ruijie#wr

**V. Verification**

1. This example shows how to verify SNMP agent status

{{:ruijie:switch:image025.png?400|}}

Following example provides how to disable SNMP agent if snmp agent issue leads to heavy load of CPU :

Ruijie(config)#no enable service snmp-agent

 

2. This examples shows how to display SNMP host information

{{:ruijie:switch:image026.png?400|}}

3. This example shows how to access the SNMP agent in a SNMP manager using "Mib-Browser"

{{:ruijie:switch:image027.png?400|}}

4. Other SNMP manager except for 192.168.1.2 cannot access SNMP agent at the same time.



**SNMPV3**

**I. Requirements**

1) The SNMP manager can access the SNMP agent on switch by applying user-based security model. The user name is "admin", authentication mode is MD5, authentication key is "ruijie", encryption algorithm is DES56, and the encryption key is "123"

2) User "admin" can read the MIB objects under System (1.3.6.1.2.1.1) node, and can only write MIB objects under SysContact (1.3.6.1.2.1.1.4.0) node.

3) The switch can actively send authentication and encryption messages to the SNMP manager  

 

**II. Network Topology**

{{:ruijie:switch:image024.png?400|}}


**III. Configuration Tips**

1. Create MIB view and specify the included or excluded MIB objects.  

2. Create SNMP group and set the version to "v3"; specify the security level of this group, and configure the read-write permission of the view corresponding to this group. 

3. Create user name and associate the corresponding SNMP group name in order to further configure the user's permission to access MIB objects; meanwhile, configure the version number to "v3" and the corresponding authentication mode, authentication key, encryption algorithm and encryption key.  

4. Configure the address of SNMP manager, configure the version "3" and configure the security level to be adopted.  

 

**IV. Configuration Steps**

Configuring switch：

Ruijie#configure terminal

Ruijie(config)#snmp-server view view1 1.3.6.1.2.1.1 include                        ------> Create a MIB view of "view1" and include the MIB object of 1.3.6.1.2.1.1

Ruijie(config)#snmp-server view view2 1.3.6.1.2.1.1.4.0 include                   ------> Create a MIB view of "view2" and include the MIB object of 1.3.6.1.2.1.1.4.0

Ruijie(config)#snmp-server group group1 v3 priv read view1 write view2    ------>Create a group named "g1" ,using SNMPv3 ; configure security level to "priv" ,and can read "view1"  and write "view2"

Ruijie(config)#snmp-server user admin group1 v3 auth md5 ruijie priv des56 ruijie123    ------>Create a user named "admin", which belongs to group "group1"; using SNMPv3 and authentication mode is "md5", authentication key is "ruijie", encryption mode is "DES56" and encryption key is "123".

Ruijie(config)#snmp-server host 192.168.1.2 traps version 3 priv admin      ------>Configure the SNMP server address as 192.168.1.2 , using SNMPv3,then configure security level to "priv" and associate the corresponding user name of "admin"

Ruijie(config)#snmp-server enable traps                                                       ------>Enable the Agent to actively send traps to NMS

Ruijie(config)#interface vlan 1

Ruijie(config-if-VLAN 1)#ip address 192.168.1.1 255.255.255.0

Ruijie(config-if-VLAN 1)#end

 

Set SNMP optional parameters

Ruijie(config)#snmp-server location fuzhou

Ruijie(config)#snmp-server contact ruijie.com.cn         

Ruijie(config)#snmp-server chassis-id 1234567890 

Note： If you don't create a new SNMP view, Ruijie switch uses the default SNMP view named "default" ,including MIB object of 1

 

Minimun SNMPv3 configuration example:

snmp-server group group1 v3 priv read default write default   

snmp-server user admin group1 v3 auth md5 ruijie priv des56 ruijie123   

snmp-server host 192.168.1.2 traps version 3 priv admin    

snmp-server enable traps   

 

**V. Verification**

1. This example shows how to verify SNMP agent status

{{:ruijie:switch:image028.png?400|}}

Following example provides how to disable SNMP agent if snmp agent issue leads to heavy load of CPU :

Ruijie(config)#no enable service snmp-agent

 

2. Following examples show how to display snmp view, snmp group and snmp user individually

{{:ruijie:switch:image029.png?400|}}

{{:ruijie:switch:image030.png?400|}}

{{:ruijie:switch:image031.png?400|}}