SNMP SNMP 1 Overview... 1 SNMP Versions... 1 Understanding MIBs... 2 MIB Object Definitions... 3 SNMP Walking... 3 SNMP Traps... 4 Adding Trap Filters... 4 Sample Trap Creation... 7 SNMP Traps Received... 10 Removing a Trap Entry... 11 Document Revision History... 11 Overview SNMP stands for Simple Network Management Protocol. The SNMP standard allows for retrieval of information (referred to as a Get) from a device, as well as altering accessible parameters within the device (referred to as a Set). LabTech mainly focuses on using SNMP to Get information, particularly information pertaining to device status (e.g. enabled/disabled) and usage (e.g. how many pages has a printer printed?) through network monitors. LabTech accesses SNMP data for a device, one piece at a time. Each piece of data is accessed by its Object Identifier (OID). Object Identifiers work in a similar manner to an IP address, in that they use a dotted notion to indicate a destination (e.g. 1.3.6.1.2.1.1.3.0 accesses the time (in hundredths of a second) since the network management portion of the system was last re-initialized). How OID's are formulated is discussed in further detail below. For typical users of LabTech, no knowledge of how SNMP works is required (other than the ability to enable SNMP and set appropriate passwords for devices on their network). The LabTech Control Center provides easy access to most commonly used OID's. For advanced users, the probe configuration section provides a mechanism to access specific information for devices via SNMP, which requires some level of SNMP understanding. This section provides an introduction access data via SNMP. It is recommended that any users interesting in using the advanced features familiarize themselves with SNMP with additional research. NOTE: Community strings, Trap Port and SNMP Timeout settings are configured on the Network Probe > General tab. To disable SNMP trap listening, set the Trap Port to 0. SNMP Versions There are three versions of SNMP: Version 1 was the first version of SNMP. This is the most commonly used version. The major drawbacks with version 1 are no support for 64-bit numbers and poor security. 10.41.189.SNMP 1
SNMP Version 2 initially provided support for 64-bit numbers, as well as an enhanced security model. However, the version 2 security model is not widely accepted. Because of this, there are multiple standards of Version 2, the most commonly used being Version 2vc. This is the version supported by LabTech. Version 2 is used mostly by high speed routers and switches to count incoming/outgoing bytes. Version 3 provides encryption (scrambling of the message so it is not viewable across the network) and authentication (verification that the snmp message actually came from the device in question, and was not tampered with) Understanding MIBs Versions 1 and 2 use an access keyword, referred to as the Community Name (or Community String), as a simple form of security. However, this method is not secure due to the fact the community name is simply placed in the header of the message, and thus visible to anyone monitoring the network. Most modern devices have two community names, one that provides read-only access to the device (the 'public' community name), and a private one that allows writing to certain objects. SNMP is a standard protocol that devices support to Get and Set information. The actual information each device contains is referred to as the device's MIB, which stands for Management Information Base. This information is almost always described in one or more MIB-modules. Each object in an MIB is required to be defined by a single ASCII string, and is typically the concatenation of multiple words and abbreviations describing the element (e.g. ifoutbroadcastpkts, hrprinterdetectederrorstate). MIB information exists in a tree-like structure. The benefit of using a tree-like structure is that it allows for the addition of new data items without disrupting prior configurations. To demonstrate the tree structure, an MIB representing a human being might be organized as follows: humanbeing (1) o PhysicalFeatures (4) Face (7) Forehead (2) o ConcentrationLines(1) o ForeheadHeight(2) Notice the numbers next to each object name. Each object in a MIB has a corresponding code number. Objects are accessed in a MIB by using the correct OID (Object Identifier), which is a concatenation of all code numbers in the tree structure. For example, the correct OID to get the number of concentration lines on a person's forehead would be "1.4.7.2.1.0". Notice how the OID ends with the number 0. Data objects that only exist once, such as a person's height, weight, or birthday, are always accessed with a "0" indicating a single value. Objects that may exist more than once (typically referred to as table data) are accessed with an index, where the meaning and range of the indexes is defined in the MIB. To demonstrate this, let's add eyes to the Face. So our MIB now looks like this: humanbeing (1) o PhysicalFeatures (4) 10.41.189.SNMP 2
Face (7) Forehead (2) o ConcentrationLines(1) o ForeheadHeight(2) o Eyes (3) o EyeIndex (1) o EyeColor(2) o PupilRadius(3) For the purposes of this discussion, let's assume that an index of 1 refers to the left eye, while an index of 2 refers to the right eye. So, to access the left eye color, the correct OID is 1.4.7.3.2.1, while for the right eye's pupil radius, the correct OID is 1.4.7.3.3.2. MIB Object Definitions MIB modules are text files that contain all of the information necessary to access a device. It is not necessary that users are capable of parsing MIB modules, since the LabTech Control Center handles MIB parsing. However, a basic understanding of how actual objects are defined may be helpful. To do this, let's review an object definition. The following is the definition for the sysdescr object, which is mandatory for every SNMP device. sysdescr OBJECT-TYPE SYNTAX DisplayString (SIZE (0..255)) ACCESS read-only STATUS mandatory DESCRIPTION "A textual description of the entity. This value should include the full name and version identification of the system's hardware type, software operating-system, and networking software. It is mandatory that this only contain printable ASCII characters." ::= { system 1 } Each MIB Object typically has the following information: SNMP Walking SYNTAX: How the data is formatted. This can vary from text (OCTECT STRING) to numbers (INTEGER) to a custom format, such as 3 bytes that contain hour, minute, and second. In the example above, the DisplayString is a convention (found elsewhere in the MIB-module) that indicates the field is text. ACCESS: Determines whether the device can be read and/or written to. STATUS: Whether the object must be supported by any device that claims to support the MIB module. DESCRIPTION: Description of the information contained in the field. This description is the most important piece of information for LabTech users. In addition to Get and Set, SNMP supports the GetNext command. This command gets the OID after the OID specified. Using the GetNext command, it is possible to iterate through all the objects in an MIB. This iteration is referred to as Walking. 10.41.189.SNMP 3
SNMP SNMP Traps The purpose of the SNMP Trap tab is to allow you to set filters to define which traps should be accepted and which are thrown out. A trap has to pass a filter in order for it to be sent to the server. Devices must be configured to send SNMP traps to the probe-enabled computer. To enable and configure traps, review the specific device's documentation. Exclusive use of traps is not recommended for the following reasons: Traps only report some of the issues that indicate there is a problem with the device. For example, a device that has no power obviously cannot send a trap indicating power loss, but a constant network monitor will detect this issue. SNMP traps use the UDP protocol, which is not guaranteed to be received by the SNMP trap listener. SNMP traps are typically not rebroadcast. Figure 1: Sample SNMP Traps The SNMP Traps tab will show all trap filters that have been created along with the parameters that define what traps are passed through to LabTech. Adding Trap Filters The purpose behind creating traps is to have devices notify the probe of abnormal conditions. A Trap operation is different than the Get, GetNext and Set operations because it is initiated from a managed device. A trap message is used to alert to the fact that a specific threshold has been reached, or that an error/event of some type has occurred. To add SNMP traps, follow the steps listed below: 1. Double-click on the probe-enabled computer from the navigation tree in the Control Center. 2. Select the Network Probe tab > SNMP Traps tab. This will display all SNMP traps that have been created. 10.41.189.SNMP 4
Figure 2: SNMP Traps 3. Right-click in the white space and select Add Trap from the menu that displays. Figure 3: Sample SNMP Trap 4. Enter the desired Name for the trap you want to create. The IP Address Filter, OID Value Filter, Generic Type Filter and Specific Code Filter can all be used in conjunction with each other or individually. 10.41.189.SNMP 5
SNMP 5. If applicable, select the IP Address Filter field and enter the IP Address of the printer or router generating the trap in the IP Address field. If this field is not checked, it will ignore the IP address. 6. If applicable, select the OID Value Filter and enter the OID value or click on the ellipsis button to select from the OID selector. For this example, we entered an OID for upsalarmonbattery. The upsalarmbattery will return two possible results (1=is not drawing power from the batteries or 2= is drawing power from the batteries). a) Select the Check Condition from the drop-down menu. b) Enter the Result that you want the trap to report on. Using the above example, we want a trap for any UPSs drawing power from the batteries. 7. For an alert to be generated when a trap is received, select the desired alert template from the Alert Template drop-down. If there is not an appropriate template available, you can choose to create a new template. For additional information on how to create a new template or edit the alerts on an existing template, please refer to the Alert Templates documentation. 8. If applicable, select the Generic Type Filter. Refer to the following table for standard generic traps. For example, if we select Equals and 4 in the Result field, a trap will be created for authentication failures. a) Select the Check Condition from the drop-down menu. b) Enter the Result that you want the trap to report on. 9. If applicable, select the Specific Code Filter. Typically, specific codes are manufacturer specific. a) Select the Check Condition from the drop-down menu. b) Enter the Result that you want the trap to report on. Table 1: Generic Trap Descriptions Trap Name/Number coldstart (0) warmstart(1) linkdown(2) linkup(3) authenticationfailure(4) egpneighborloss(5) Description Indicates that the device has rebooted. All management variables will be reset; specifically, Counters and Gauges will be reset to zero (0). Indicates that the agent has reinitialized itself. None of the management variables will be reset. Sent when an interface on a device goes down. The first variable binding identifies which interface went down. Sent when an interface on a device comes back up. The first variable binding identifies which interface came back up. Indicates that someone has tried to query your agent with an incorrect community string; useful in determining if someone is trying to gain unauthorized access to one of your devices. Indicates that an Exterior Gateway Protocol (EGP) neighbor has gone down. 10.41.189.SNMP 6
enterprisespecific(6) Indicates that the trap is enterprisespecific. SNMP vendors and users define their own traps under the privateenterprise branch of the SMI object tree. 10. Once you have entered the appropriate information, click Save. 11. Select Begin > Commands > Probe > Refresh Configuration to update the configuration. It can take up to 10 minutes for the probe to update its configuration based on its activity. You can check the progress by looking at the Network Probe > Probe Commands tab. Any time changes are made you will need to update the configuration. NOTE: To edit a trap, right-click on the trap and select Edit Trap from the menu or simply double-click. Make the appropriate changes and click Save. To delete a trap, right-click on the trap and select Delete Trap. You will be prompted to confirm. Click Yes to delete. Sample Trap Creation The Vertical Wave IP system sends traps in response to events taking place. For these traps, the value sent in the trap is the number of the trunk affected. The specific code sent in the header of the trap actually indicates what event has taken place. A subset of the traps, taken from Eventlog.mib, is shown below: 10.41.189.SNMP 7
SNMP Figure 4: Sample Eventlog.mib Subset of Traps For this example, we want to capture when the voice mail disk is full (e.g., eventlog- VoiceMailDiskIsFull). According to the above example log, 57 is sent when the voice mail capacity has been reached. 1. From the SNMP Traps tab, right-click in the white space 10.41.189.SNMP 8
Figure 5: Sample SMTP Trap Specific Code 2. Enter the name. For our example, we will enter Wave Device Voice Mail Full. 3. Select the Specific Code Filter checkbox to enable the Check Condition and Result fields. 4. Select Equals from the Check Condition drop-down. 5. Enter 57 in the Result field. 6. Typically, when a specific code is sent with the trap, the generic code is required to be 6, so adding a check for code 6 is a viable option. Figure 6: Sample SMTP Trap Generic and Specific Code 10.41.189.SNMP 9
SNMP NOTE: Given that other devices may use code 57, some additional filtering is probably a good idea. You could filter on IP address or if you know the trap OID, you can use this. For the current example, the Wave device OID is constant for all traps sent so that can be used. Figure 7: Sample SNMP Trap OID Filter, Generic & Specific Code Filters 7. Click Save. This will create a trap to receive messages when the voice mail is full based on the information provided in the Eventlog.mib. SNMP Traps Received The SNMP Traps Received will show you all the SNMP traps that have been received based on the trap filters you have created on the SNMP Traps tab. Figure 8: SNMP Traps Received 10.41.189.SNMP 10
Table 2: SNMP Traps Received Column IP Address OID Trap OID Trap Value Record Time SNMP Version Description Displays the IP address of the device. Displays the OID of the received trap. Displays the OID that came over in the trap. The last two numbers of the trap value indicate the generic and specific codes. For example, for the OID 1.3.6.1.4.1.9.6.1; 6 is the generic code and 1 is the specific code. Displays the trap value. Displays the date and time that the trap was received. Indicates the SNMP version. V3 may process traps differently from versions 1 and 2. From this screen, there are additional options. You can refresh the list, copy the text, search the list, print the list or export the list to Excel. Each of these options can be accessed by right-clicking in the white space of the window. Removing a Trap Entry If you want to remove a trap entry from the SNMP Traps Received listing, be aware that you will not be prompted to confirm the removal. 1. To remove a trap entry, right-click on the trap and select Remove Trap Entry from the menu that displays. Document Revision History Date Notes 04/11/2011 Updated for 2011 release 09/01/2011 Added Update Configuration to list of steps after creating traps. 10.41.189.SNMP 11