Configuring SNMPb as SNMP manager/trap daemon for IDENTIKEY Authenitcation Server.

Transcription

1 KB Configuring SNMPb as SNMP manager/trap daemon for IDENTIKEY Authenitcation Server. Creation date: 18/06/2015 Last Review: 1/07/2015 Revision number: 2 Document type: How To Security status: INTERNAL Summary This KB explains how to install and configure an SNMP manager (SNMPb) for monitoring IDENTIKEY Authentication Server (IAS) /IDENTIKEY Appliance (IA). SNMPb can then be used as MIB browser and an SNMP trap daemon. Problem symptoms / details. Sometimes you want to experiment with the SNMP functionality provided by IAS. This requires an SNMP manager to be installed and configured properly. This How-To explains how to set up and configure SNMPb such that it allows you to: Browse the MIBs Perform SNMP get/walk/bulkwalk requests on a (group of) OIDs Act as SNMP trap daemon (receiving SNMP traps / informs) Besides that, this KB gives a brief example on how to obtain information from the MIB. Problem Solution. The SNMP manager that is used in this guide is SNMPb. To obtain the most recent version, visit For this how-to version 0.8 has been used. Prerequisites The SNMP functionality has been configured in IAS / IA and you know its settings. During installation of IAS, you could e.g. provide these SNMP parameters: username: snmpuser (does not have to be an IAS / Windows user) port: 161 Authentication type/secret: md5 / Test1234 Privacy type/secret: AES / Test1234 Page 1 of 6

2 If unsure about the SNMP parameters, you can run the maintenance wizard / configuration utility to specify them again. SNMBb installation and configuration 1. Install and configure SNMPb ( or grab it from the WQA\software share). SNMPb can be installed on a separate machine. 2. Start up SNMPb and perform the following steps 1. Create SNMPv3 USM profile Options -> manage SNMPv3 USM profiles -> right click left pane and select New USM profile. Provide the parameters as specified while configuring IAS/IA 1. Security User Name = e.g. snmpuser 2. Authentication protocol/password = e.g. md5/test Privacy protocol/password e.g. AES/Test1234 Note: if IAS has been configured to use AES for privacy protocol, select AES128 from the drop down menu in SNMPb) 2. Create agent profile: Options -> Manage agent profiles -> right click the left pane and select New agent profile and enter the following settings: 1. Provide a name and enter the IAS/IA IP address in the agent address/name field 2. Set supported SNMP version to SNMPv2 AND SNMPv3 3. in Snmp V3, select USM profile created in step Set security level to authpriv. 3. Load the MIBS required for IAS 1. Create a mibs-vasco subfolder in the SNMPb installation folder 2. Copy the IAS specific MIBs (delivered with IAS/IA) to the folder created in the previous step and remove their.txt extension. On Windows based IAS installations, the IAS MIBS can be found in C:\Program Files\VASCO\Identikey 3.x\mibs, for Linux in /opt/vasco/ias/mibs. On the IA they can be downloaded from the configuration interface. 3. Add the folder created in step 3.1 to the SNMPb search path: Page 2 of 6

3 4. Load the MIBS: 1. In SNMPb: Options -> preferences -> Modules. Add the string mibs-vasco to the search path In the SNMPb main screen, select the Modules tab and add load the following MIB s: 1. INET-ADDRESS-MIB 2. RADIUS-AUTH-CLIENT 3. RADIUS-AUTH-SERVER 4. VASCO-IDENTIKEY-COMMUNICATOR-SEAL-MIB 5. VASCO-IDENTIKEY-COMMUNICATOR-SOAP-MIB 6. VASCO-IDENTIKEY-CRYPTO-MIB 7. VASCO-IDENTIKEY-DATAMODEL-MIB 8. VASCO-IDENTIKEY-MIB 9. VASCO-IDENTIKEY-SCENARIO-MIB 10. VASCO-MIB 4. Set Binding trap port to 162: In SNMPb: Options -> preferences-> traps and set port to 162. Browse / obtain data from the MIB IAS will only send data to the MIBs when system monitoring, performance monitoring and the counters plug-in are activated. To activate these, start the IAS configuration utility and 1. Go to Monitoring enable system monitoring (checkbox) 2. Go to Peformance and 1. Enable performance monitoring (checkbox) 2. As filter, you can leave the default * (will monitor everything). Please check the online help in case you want to filter on what is being monitored. 3. In the Plug-ins tab, go to Counter Plugin and check Enable Counter Plug-in To poll for information stored in the MIBs, using SNMBb, navigate to the OID of your choice, right click and select Get, Get Bulk as indicated in the screenshot below. In the Query results pane you ll see the values obtained. Page 3 of 6

4 The VASCO IAS specific MIBs can be found under iso.dod.internet.private.enterprises.vascodatasecurity (OID ). Receiving TRAPS from IAS SNMPb can also be used as a trap daemon. This means that it can act as a target for IAS system monitoring messages that are delivered using SNMP traps/informs. The steps below will instruct you to: To create an SNMP trap monitoring target in IAS Configure SNMPb to receive those traps Generate a trap The example below will make use of SNMPv3 traps. Note that IAS supports TRAPv3, TRAPv2c and INFORM. Configuration of informs and TRAPv3 is identical. For SNMPv2c a community string (shared secret) is used instead of an USM profile. 1. Creating a SNMPv3 target in IAS: To create this target start the IDENTIKEY Authentication Server Configuration utility and go to the Monitoring section => targets tab. You can create a target as indicated in the screenshot below. Page 4 of 6

5 2. Configure SNMPb to receive traps In SNMPB, create an USM profile matching the settings specified in IAS monitoring target. (see the SNMBb installation and configuration, section 2.2 above for instructions) 3. Generate a trap a. Using the IDENTIKEY Authentication Server Configuration utility, create a monitoring filter and assign the SNMP trap target created earlier to it: Page 5 of 6

6 b. Perform an action that triggers the rule => the trap now shows up in SNMPb (Trap tab). Page 6 of 6