© 2012 Cisco and/or its affiliates. All rights reserved. 1 Configuring SNMP

© 2012 Cisco and/or its affiliates. All rights reserved. 2 The Simple Network Management Protocol (SNMP) is part of TCP/IP as defined by the IETF. It is used by network management systems to monitor network- attached devices for conditions that warrant administrative attention. It consists of a set of standards for network management, including an Application Layer protocol, a database schema, and a set of data objects.

© 2012 Cisco and/or its affiliates. All rights reserved. 3 Managers: –In any configuration, at least one manager node runs SNMP management software. Agents: –Network devices that need to be managed, such as switches, routers, servers, and workstations, are equipped with an agent software module. Management Information Base (MIB): –The agent is responsible for providing access to a local MIB of objects that reflects the resources and activity at the agent’s node.

© 2012 Cisco and/or its affiliates. All rights reserved. 4 Network Management System (NMS) Agents MIB –Managed devices

© 2012 Cisco and/or its affiliates. All rights reserved. 5 An NMS executes applications that monitor (and possibly control) managed devices. The NMS provides the bulk of the processing and memory resources required for network management. One or more NMSs must exist on any SNMP network.

© 2012 Cisco and/or its affiliates. All rights reserved. 6

7

8 Nagios: Nagios –Is an open source management system with many features, aimed primarily at host and service monitoring. It can, however, be used to fill the role of a full-blown SNMP- based management system by setting it up to receive SNMP traps. Nagios can then generate alerts based on traps received from hosts and network devices. Nagios is suited to service monitoring, with its ability to connect to SMTP, POP3, HTTP, NNTP, PING, etc. Nagios even allows advanced monitoring of host statistics, such as disk usage, temperature, load, etc. Nagios has the ability to produce availability charts and graphs as well. It focuses on NOC operations by allowing you to schedule downtimes (i.e. suppress notifications) and track problem resolutions. Being open source and having a decent API also means that there are hundreds of plug-ins for Nagios. Nagios does lack discovery capabilities, however. Netdisco: Netdisco –Is another NMS Suite designed for Linux-only that has a specific focus. As the name implies, the focus is on network discovery. If this is most important to you, Netdisco is definitely worth a look. Netdisco provides layer 2 discovery. It creates mappings from IP and MAC addresses to switch ports, and provides a good interface for searching the discovered information. Netdisco provides many useful reports as well, including: a clickable graph of the network topology, statistics about the number of nodes connected, and a great listing of security concerns such as rogue wireless access points and hosts using IP addresses that aren't in DNS.

© 2012 Cisco and/or its affiliates. All rights reserved. 9 WhatsUp: WhatsUp –Is a very popular monitoring system that runs on Windows only. WhatsUp is a fairly complete NMS, implementing: monitoring, discovery, and reporting. It can even catch SNMP traps and provide information about devices using its SNMP Viewer. The intuitive interface, world-class maps and diagrams, and ease of use make WhatsUP preferred by many. It is a very popular monitoring system that runs on Windows only. Big Brother's: Big Brother's –Focus is purely on monitoring. Big Brother is a customizable monitoring system that is easy to set up. It works on both Unix and Windows servers and clients. The web interface shows a statistics page with simple "red = bad, green = good" scheme. Big Brother can monitor services, as well as act simply as a ping tool. Cricket: Cricket –Is a one-feature piece of software, but it deserves mention here. Cricket graphs important data based on SNMP data collected from routers and switches. Most common uses include data rate of every port and temperature/COU usage. Virtually every site uses this package in conjunction with other NMS tools, since it excels at gathering and displaying this important information.

© 2012 Cisco and/or its affiliates. All rights reserved. 10 Others out there, but they're generally commercial products that are complex to use. –HP OpenView is good at translating SNMP events and drawing layer 3 maps. –Configuring events, such as "page me when this fails" is non-trivial. WhatsUp, Netdisco, and Nagios are widely-used applications. Most people chose to run Nagios in parallel with something similar to Netdisco or WhatsUp, since Nagios provides advanced host monitoring solutions.

© 2012 Cisco and/or its affiliates. All rights reserved. 11 An agent is a network-management software module that resides in a managed device. An agent has local knowledge of management information and translates that information into a form compatible with SNMP.

© 2012 Cisco and/or its affiliates. All rights reserved. 12

© 2012 Cisco and/or its affiliates. All rights reserved. 13 A managed device is a network node that contains an SNMP agent and that resides on a managed network. Managed devices can be routers and access servers, switches and bridges, hubs, computer hosts, or printers. Managed devices collect and store management information and make this information available to NMSs using SNMP.

© 2012 Cisco and/or its affiliates. All rights reserved. 14 SNMP asks agents for information or tells the agents to do something. In SNMPv1, asynchronous event reports are called traps while in later versions they are called notifications. The actions GET and SET are the vulnerabilities that open SNMP to an attack.

© 2012 Cisco and/or its affiliates. All rights reserved. 15 SNMP Manager SNMP Agent GetRequest GetNextRequest GetBulkRequest SetRequest Report InformRequest Response Trap To another Manager

© 2012 Cisco and/or its affiliates. All rights reserved. 16 GET REQUEST –Used to retrieve a piece of management information. GETNEXT REQUEST –Used interactively to retrieve sequences of management information. GET RESPONSE –Agent responds with data to get and sends requests from the manager. SET REQUEST –Used to initialize and make a change to a value of the network element. TRAP –Used to report an alert or other asynchronous event about a managed subsystem.

© 2012 Cisco and/or its affiliates. All rights reserved. 17 Other PDUs were added in later versions, including: –GETBULK REQUEST - a faster iterator used to retrieve sequences of management information. –INFORM - an acknowledged trap.

© 2012 Cisco and/or its affiliates. All rights reserved. 18

© 2012 Cisco and/or its affiliates. All rights reserved. 19 SNMP uses: –UDP port 161 for the agent –UDP port 162 for the manager. The Manager may send Requests from any available ports (source port) to port 161. –The agent response will be given back to the source port. The Manager will receive traps on port 162. –The agent may generate traps from any available port.

© 2012 Cisco and/or its affiliates. All rights reserved. 20 SNMPv1 and SNMPv2 use a community string to access router SNMP agents –SNMP community strings act like passwords –An SNMP community string is a text string used to authenticate messages between a management station and an SNMP engine Read Only Community String: –Community strings can obtain information but cannot set information in an agent. Read-Write Community Strings: –Community strings can obtain and set information in an agent.

© 2012 Cisco and/or its affiliates. All rights reserved. 21 SNMP agents accept commands and requests only from SNMP systems that use the correct community string. In effect, having read-write access is equivalent to having the enable password! By default, most SNMP systems use a community string of “public” –This is a security problem! If the router SNMP agent is configured to “public”, anyone with an NMS system is able to read the router MIB. –Router MIB variables can point to entities like routing tables and other security-critical components of a router configuration. It is very important that custom SNMP community strings are created!

© 2012 Cisco and/or its affiliates. All rights reserved. 22 A security model is an authentication strategy that is set up for a user and the group that the user resides in. Currently, Cisco IOS software supports three security models: –SNMPv1 –SNMPv2 (variations - SNMPv2p, SNMPv2c, SNMPv2 (SNMPv2u, and SNMPv2*) –SNMPv3. SNMPv1 and v2 are considered obsolete, and are extremely insecure. –It is recommended they NOT be used on a publicly attached network. SNMP3 adds administration and security features.

© 2012 Cisco and/or its affiliates. All rights reserved No Yes It uses cleartext authentication strings. Sends strings repeatedly as part of periodic polling. Easily spoofable, datagram-based transaction protocol. Uses the same PDUs as version 1 Add two new PDUs called GetBulk and Inform. Different variations developed to address security issues Username match for authentication Increased message integrity Authentication based on HMAC-MD5 or HMAC- SHA Encryption based on CBC-DES

© 2012 Cisco and/or its affiliates. All rights reserved. 24 SNMPv3 is an interoperable standards-based protocol for network management. –SNMPv3 provides secure access to devices by a combination of authenticating and encrypting packets over the network. There are three security features that SNMPv3 provides: –Authentication –Message integrity –Encryption

© 2012 Cisco and/or its affiliates. All rights reserved. 25

© 2012 Cisco and/or its affiliates. All rights reserved. 26

© 2012 Cisco and/or its affiliates. All rights reserved. 27 Security level is the permitted level of security within a security model. –The security level is a type of security algorithm that is performed on each SNMP packet. There are three security levels: –noAuth: (SNMPv1 – V3) Authenticates a packet by a string match of the user name or community string. –Auth: (SNMPv3) Authenticates a packet by using either the Hash-based Message Authentication Codes (HMACs) with MD5 or Secure Hash Algorithms (SHAs). –Priv: (SNMPV3) Same as Auth but also encrypts the packet using the Cipher Block Chaining-Data Encryption Standard (CBC-DES) (DES-56) algorithm.

© 2012 Cisco and/or its affiliates. All rights reserved. 28

© 2012 Cisco and/or its affiliates. All rights reserved. 29 The concepts of separate SNMP agents and SNMP managers do not apply in SNMPv3 SNMP combines these concepts into single SNMP entities –Each NMS and managed node creates a single SNMP entity

© 2012 Cisco and/or its affiliates. All rights reserved. 30 The single SNMP entity consists of two types of sub-entities, each containing different applications: –SNMP NMS entity –Managed node SNMP entity

© 2012 Cisco and/or its affiliates. All rights reserved. 31 The SNMP NMS entity includes: –An SNMP manager –SNMP applications.

© 2012 Cisco and/or its affiliates. All rights reserved. 32 The SNMP manager implements the SNMP protocol and collects information from managed nodes and sends instructions to the nodes. –The SNMP applications are software applications used to manage the network.

© 2012 Cisco and/or its affiliates. All rights reserved. 33 The managed node SNMP entity includes: –An SNMP agent –An SNMP MIB

© 2012 Cisco and/or its affiliates. All rights reserved. 34 The SNMP agent implements the SNMP protocol and allows a managed node to provide information to the NMS and accept instructions from the NMS. –The MIB defines the information that can be collected and used to control the managed node. –Information that is exchanged using SNMP takes the form of objects from the MIB

© 2012 Cisco and/or its affiliates. All rights reserved (Optional) Configure the SNMP-server engine ID to identify the devices for administrative purposes 2. Configure the SNMP-server group names for grouping SNMP users 3. Configure the SNMP-server users to define usernames that reside on hosts that connect to the local agent 4. Configure SNMP Traps (Informs) 5. Configure the SNMP-server hosts to specify the recipient of a notification operation (trap or inform)

© 2012 Cisco and/or its affiliates. All rights reserved. 36 Trap_sender(config)# snmp-server group SNMP-GROUP v3 auth Trap_sender(config)# snmp-server group SNMP-GROUP v3 priv Trap_sender(config)# snmp-server user snmpuser SNMP-GROUP v3 auth md5 authpassword priv des56 encryptpassword Trap_sender(config)# snmp-server enable traps cpu Trap_sender(config)# snmp-server enable traps config Trap_sender(config)# snmp-server enable traps snmp Trap_sender(config)# snmp-server host traps version 3 priv snmpuser Trap_sender(config)# snmp-server source-interface traps loopback 0a Walked_device(config)# snmp-server group SNMP-GROUP v3 auth Walked_device(config)# snmp-server group SNMP-GROUP v3 priv Walked_device(config)# snmp-server user snmpuser SNMP-GROUP v3 auth md5 authpassword priv des56 encryptpassword

© 2012 Cisco and/or its affiliates. All rights reserved. 37 A remote engine ID can be created when an SNMPv3 inform is configured. The remote engine ID is used to compute the security digest for authenticating and encrypting packets that are sent to a user on the remote host. –Informs are acknowledged traps. –The agent sends an inform to the manager. –When the manager receives the inform, the manager sends a response to the agent. –Thus, the agent knows that the inform reached the intended destination.

© 2012 Cisco and/or its affiliates. All rights reserved. 38  (Optional) To configure a name for either the local or remote SNMP engine, use the global configuration command snmp- server engineID. –The SNMP engine ID is a unique string used to identify the device for administration purposes. –An engine ID is not required for the device as a default string is generated using a Cisco enterprise number ( ) and the MAC address of the first interface on the device.

© 2012 Cisco and/or its affiliates. All rights reserved. 39 Do not specify the entire 24-character engine ID if the ID contains trailing zeros. –Specify only the portion of the engine ID up to the point at which only zeros remain in the value. –This portion must be 10 hexadecimal characters or more. –For example, to configure an engine ID of , specify snmp-server engineID local 1234

© 2012 Cisco and/or its affiliates. All rights reserved. 40  To configure a new SNMP group, use the global configuration command snmp-server group. –This command groups SNMP users that reside on hosts that connect to the local SNMP agent. snmp-server group groupname {v1 | v2c | v3 {auth | noauth | priv}} [read readview] [write writeview] [notify notifyview] [access access-list] Router(config)# Configures a new SNMP group or a table that maps SNMP users to SNMP views.

© 2012 Cisco and/or its affiliates. All rights reserved. 41 PR1(config)# snmp-server group JOHN-GROUP v3 auth PR1(config)# snmp-server group BILL-GROUP v3 priv The first example shows how to define a group JOHN-GROUP for SNMP v3 using authentication but not privacy (encryption). The second example shows how to define a group BILL-GROUP for SNMP v3 using privacy.

© 2012 Cisco and/or its affiliates. All rights reserved. 42  To add a new user to an SNMP group, use the global configuration command snmp-server user.  To configure a user that exists on a remote SNMP device, specify the IP address or port number for the remote SNMP device where the user resides  Note: –Before configuring remote users for that device, configure the SNMP engine ID using the command snmp-server engineID with the remote option. –If the remote engine ID is not configured first, the configuration command will fail.

© 2012 Cisco and/or its affiliates. All rights reserved. 43 Configure a new user to an SNMP group. snmp-server user username groupname [remote ip-address [udp-port port]] {v1 | v2c | v3 [encrypted] [auth {md5 | sha} auth-password [priv des56 priv-password]]} [access access-list] Router(config)#

© 2012 Cisco and/or its affiliates. All rights reserved. 44 The first example shows how to define a user John belonging to the group JOHN-GROUP. Authentication uses the password john2passwd and no privacy (no encryption) is applied. The second example shows how user Bill, belonging to the group BILL-GROUP, is defined using the password bill3passwd and privacy (encryption) is applied. PR1(config)# snmp-server user John JOHN-GROUP v3 auth md5 john2passwd PR1(config)# snmp-server user Bill BILL-GROUP v3 auth md5 bill3passwd priv des56 password2

© 2012 Cisco and/or its affiliates. All rights reserved. 45  To enable all SNMP notifications (traps or informs) available on your system, use the snmp-server enable traps command in global configuration mode.  If an snmp-server enable command is NOT entered, no notifications are sent. –To configure the router to send SNMP notifications, at least one snmp- server host command must be entered –If the command is entered with no keywords, all trap types are enabled for the host.

© 2012 Cisco and/or its affiliates. All rights reserved. 46

© 2012 Cisco and/or its affiliates. All rights reserved. 47 SNMP notifications can be sent as traps or inform requests. –Traps are unreliable because the receiver does not send acknowledgments when the receiver receives traps. –The sender cannot determine if the traps were received. An SNMP entity that receives an inform request acknowledges the message with an SNMP response PDU. –Informs consume more computing resources in the agent and in the network. To be able to send an “inform,”, use the command snmp-server enable informs.

© 2012 Cisco and/or its affiliates. All rights reserved. 48 Configures the recipient of an SNMP trap operation. This example shows how to send configuration informs to the remote host. Router(config)# PR1(config)# snmp-server engineID remote PR1(config)# snmp-server user bill BILL-GROUP remote v3 PR1(config)# snmp-server group BILL-GROUP v3 noauth PR1(config)# snmp-server enable traps PR1(config)# snmp-server host inform version 3 noauth bill PR1(config)# snmp-server manager snmp-server host host-address [traps | informs] [version {1 | 2c | 3 [auth | noauth | priv]}] community-string [udp-port port] [notification-type]

© 2012 Cisco and/or its affiliates. All rights reserved. 49 The next slide shows how to configure Cisco IOS routers for SNMPv3. –The router Trap_sender is configured to send traps to the NMS host with the IP address –The traps are encrypted using the credentials that are configured for the local user snmpuser who belongs to the group SNMP-GROUP. –The Trap_sender router sends traps that are related to CPU, configuration, and SNMP. –The trap packets are sourced from the router loopback 0 interface. The router Walked_device is configured so that the NMS host can read the MIBs on the local device. The NMS server needs to use the username credentials that are configured on the Walked_device (snmpuser with respective authentication and encryption passwords) to gain access to the SNMP information of the router.

© 2012 Cisco and/or its affiliates. All rights reserved. 50 Trap_sender(config)# snmp-server group SNMP-GROUP v3 auth Trap_sender(config)# snmp-server group SNMP-GROUP v3 priv Trap_sender(config)# snmp-server user snmpuser SNMP-GROUP v3 auth md5 authpassword priv des56 encryptpassword Trap_sender(config)# snmp-server enable traps cpu Trap_sender(config)# snmp-server enable traps config Trap_sender(config)# snmp-server enable traps snmp Trap_sender(config)# snmp-server host traps version 3 priv snmpuser Trap_sender(config)# snmp-server source-interface traps loopback 0 Walked_device(config)# snmp-server group SNMP-GROUP v3 auth Walked_device(config)# snmp-server group SNMP-GROUP v3 priv Walked_device(config)# snmp-server user snmpuser SNMP-GROUP v3 auth md5 authpassword priv des56 encrypt password

© 2012 Cisco and/or its affiliates. All rights reserved. 51 SNMP is typically used to ease troubleshooting and configuration. –However, SNMP in a production network introduces a potential vulnerability. If SNMP is required, consider: –Providing read-only access to devices via SNMP –Treat the SNMP community string with the same care that you might use for a root password on a critical UNIX host. –Use SNMPv3 authentication and encryption features.

© 2012 Cisco and/or its affiliates. All rights reserved. 52 If SNMP is not required, disable it. If SNMP is absolutely required, use it only in the read-only mode. Don’t use obvious read/write strings. Log the authentication failures. For SNMP remote access, create a basic ACL for trusted subnets to control which hosts can access the managed device.

© 2012 Cisco and/or its affiliates. All rights reserved. 53

© 2012 Cisco and/or its affiliates. All rights reserved. 54

© 2012 Cisco and/or its affiliates. All rights reserved. 55 SNMP Tutorial – NBKC4-wGgt728Ag&q=snmp&vt=lf&hl=enhttp://video.google.ca/videoplay?docid= &ei=BlLSSJ- NBKC4-wGgt728Ag&q=snmp&vt=lf&hl=en Essential SNMP – Configuring SNMP – mp_sup_ps6441_TSD_Products_Configuration_Guide_Chapter.htmlhttp:// mp_sup_ps6441_TSD_Products_Configuration_Guide_Chapter.html SNMP Server –SNMP Trap Watcher –Kiwi Enterprises