SNMP was first introduced in Chapter 5, and it will be covered in more detail in this chapter. SNMP is an Application Layer (Layer 7) protocol (using UDP ports 161 and 162) that facilitates the exchange of management information between network devices. An SNMP-managed network consists of a management system, agents, and managed devices. The management system executes monitoring applications and controls managed devices. It also executes most of the management processes and provides the bulk of memory resources used for network management. A network might be managed by one or more management systems.
An SNMP agent resides on each managed device and translates local management information data, such as performance information or event and error information caught in software traps, into a readable form for the management system. SNMP agents use GET requests that transport data to the network management software. SNMP agents capture data from Management Information Bases (MIBs), which are device parameter and network data repositories, or from error or change traps.
A managed element, such as a router, a switch, a computer, or a firewall, is accessed via the SNMP agent. Managed devices collect and store management information, making it available through SNMP to other management systems with the same protocol compatibility. Figure 24.1 below illustrates the interaction of the three primary components of an SNMP-managed network:
Figure 24.1 – SNMP Network Component Interaction
Referencing Figure 24.1 above, the managed router is the SNMP-managed device. Logically residing on the device is the SNMP agent. The SNMP agent translates local management information data, stored in the management database of the managed device, into a readable form for the management system, which is also referred to as the Network Management Station (NMS).
When using SNMP, managed devices are monitored and controlled using three common SNMP commands: read, write, and trap. The read command is used by an NMS to monitor managed devices. This is performed by the NMS examining different variables that are maintained by managed devices. The write command is used by an NMS to control managed devices. Using this command, the NMS can change the values of variables stored within managed devices. Finally, the SNMP trap command is used by managed devices to report events to the NMS. Devices can be configured to send SNMP traps or informs to an NMS.
SNMP traps are simply messages that alert the SNMP manager of a condition on the network. An example of an SNMP trap could include an interface transitioning from an up state to a down state. The primary issue with SNMP traps is that they are unacknowledged. This means that the sending device is incapable of determining whether the trap was received by the NMS.
SNMP informs are SNMP traps that include a confirmation of receipt from the SNMP manager. These messages can be used to indicate failed authentication attempts or the loss of a connection to a neighbor router, for example. If the manager does not receive an inform request, then it does not send a response. If the sender never receives a response, then the inform request can be sent again. Thus, informs are more likely to reach their intended destination.
While informs are more reliable than traps, the downside is that they consume more resources on both the router and in the network. Unlike a trap, which is discarded as soon as it is sent, an inform request must be held in memory until a response is received or the request times out. In addition, traps are sent only once, while an inform may be resent several times if a response is not received from the NMS.
Figure 24.2 below illustrates the communication between the SNMP manager and the SNMP agent for sending traps and informs:
Figure 24.2 – SNMP Communication
The three versions of SNMP are versions 1, 2, and 3. Version 1, or SNMPv1, is the initial implementation of the SNMP protocol. SNMPv1 operates over protocols such as User Datagram Protocol (UDP), Internet Protocol (IP), and the OSI Connectionless Network Service (CLNS). SNMPv1 is widely used and is the de facto network-management protocol used within the Internet community.
SNMPv2 revises SNMPv1 and includes improvements in the areas of performance, security, confidentiality, and manager-to-manager communications. SNMPv2 also defines two new operations:
- GetBulk
- Inform
The GetBulk operation is used to retrieve large blocks of data efficiently. The Inform operation allows one NMS to send trap information to another NMS and then to receive a response. In SNMPv2, if the agent responding to GetBulk operations cannot provide values for all the variables in a list, then it provides partial results.
SNMPv3 provides the following three additional security services that are not available in previous versions of SNMP: message integrity, authentication, and encryption. SNMPv3 uses message integrity to ensure that a packet has not been tampered with in-transit. SNMPv3 also utilizes authentication, which is used to determine whether the message is from a valid source. Finally, SNMPv3 provides encryption, which is used to scramble the contents of a packet to prevent it from being seen by unauthorized sources.
Next, we will provide a few examples of the parameters monitored by an NMS (graphical view) via the SNMP protocol. Figure 24.3 below illustrates a sample report for interface utilization on a network device:
Figure 24.3 – SNMP Interface Utilization Example
Figure 24.4 below illustrates a sample report for CPU parameters (e.g., utilization, temperature, and fan) on a network device:
Figure 24.4 – SNMP CPU Monitoring Example
MIB browsers are dedicated software tools that manage SNMP-enabled network devices. They allow administrators to load standard and proprietary MIBs and issue SNMP requests to retrieve data or make changes to an agent. A sample interface example of an MIB browser is presented in Figure 24.5 below:
Figure 24.5 – MIB Browser Example
SNMP Configuration Example (Cisco IOS)
In this section, we will analyze the way SNMP is configured on a common network device, a Cisco router in this case. In Cisco IOS software, the snmp-server host [hostname | address] command is used to specify the hostname or IP address of the NMS to which the local device will send traps or informs. To allow the NMS to poll the local device, SNMPv1 and SNMPv2c require that a community string be specified for either read-only or read-write access using the snmp-server community <name> [ro | rw] global configuration command.
SNMPv3 does not use the same community-based form of security but instead uses user and group security. The following configuration example illustrates how to configure the local device with two community strings, one for read-only access and the other for read-write access. In addition, the local device is also configured to send SNMP traps for syslog to 1.1.1.1 using the read-only community string:
| Router(config)#conf t
Enter configuration commands, one per line. End with CNTL/Z. Router(config)#snmp-server community read_pw RO Router(config)#snmp-server community write_pw RW Router(config)#snmp-server host 10.10.10.1 traps password syslog
|