Operation Manual SNMP. Table of Contents

Transcription

1 Table of Contents Table of Contents SNMP Overview Introduction to SNMP SNMP Versions and Supported MIB Configuring SNMP Setting Community Names Setting the System Information Enabling SNMP Agent to Send Traps Setting the Destination Address of Trap Setting Lifetime of Trap Message Setting the Engine ID of a Local Device Setting an SNMP Group Setting the Source Address of Trap Adding a User to an SNMP Group Creating/Updating View Information Setting the Size of the SNMP Packet Sent/Received by an Agent Disabling SNMP Agent Extending the Standard linkup/linkdown Traps Displaying and Debugging SNMP SNMP Configuration Examples Common SNMP Configuration Example Configuration Example for Private Network Support i

2 When configuring SNMP, go to these sections for information you are interested in: SNMP Overview Configuring SNMP Displaying and Debugging SNMP SNMP Configuration Examples 1.1 SNMP Overview Introduction to SNMP By far, Simple Network Management Protocol (SNMP) has gained the most extensive application in the computer networks. SNMP has been put into use and widely accepted as an industry standard in practice. It is used for ensuring the transmission of the management information between any two nodes. In this way, network administrators can easily search and modify the information on any node on the network. In the meantime, they can locate faults promptly and implement the fault diagnosis, capacity planning and report generating. SNMP adopts the polling mechanism and provides the most basic function set. It is most applicable to the small-sized, fast-speed and low-cost environment. It only requires the unverified transport layer protocol UDP; and is thus widely supported by many other products. In terms of structure, SNMP can be divided into two parts, namely, Network Management Station and Agent. Network Management Station is the workstation for running the client program. At present, the commonly used NM platforms include Sun NetManager and IBM NetView. Agent is the server software operated on network devices. Network Management Station can send GetRequest, GetNextRequest and SetRequest messages to the Agent. Upon receiving the requests from the Network Management Station, Agent will perform Read or Write operation according to the message types, generate and return the Response message to Network Management Station. On the other hand, Agent will send Trap message on its own initiative to the Network Management Station to report the events whenever the device encounters any abnormalities such as restart SNMP Versions and Supported MIB To uniquely identify the management variables of a device in SNMP messages, SNMP adopts the hierarchical naming scheme to identify the managed objects. It is like a tree. A tree node represents a managed object, as shown in the figure below. Thus the object can be identified with the unique path starting from the root. 1-1

3 B A Figure 1-1 Architecture of the MIB tree The MIB (Management Information Base) is used to describe the hierarchical architecture of the tree and it is the set defined by the standard variables of the monitored network device. In the above figure, the managed object B can be uniquely specified by a string of numbers { }. The number string is the Object Identifier of the managed object. The current SNMP Agent of switch supports SNMP V1, V2C and V3. The MIBs supported are listed in the following table. Table 1-1 MIBs supported by the switch MIB attribute MIB content References Public MIB MIB II based on TCP/IP network device BRIDGE MIB RIP MIB RMON MIB Ethernet MIB OSPF MIB IF MIB RFC1213 RFC1493 RFC2675 RFC1724 RFC2819 RFC2665 RFC1253 RFC

4 MIB attribute MIB content References DHCP MIB QACL MIB ADBM MIB Private MIB RSTP MIB VLAN MIB Device management Interface management 1.2 Configuring SNMP The following sections describe the SNMP configuration tasks. Setting Community Names Setting the System Information Enabling SNMP Agent to Send Trap Setting the Destination Address of Trap Setting Lifetime of Trap Message Setting the Engine ID of a Local Device Setting an SNMP Group Setting the Source Address of Trap Adding a User to an SNMP Group Creating/Updating View Information Setting the Size of the SNMP Packet Sent/Received by an Agent Disabling SNMP Agent Extending the Standard linkup/linkdown Traps Setting Community Names SNMP V1 and SNMPV2C adopt the community name authentication scheme. SNMP Community is named with a character string, which is called community name. SNMP community name defines the relationship between SNMP manager and SNMP agent. The community name functions like a password, that is, it controls the access of the SNMP manager to the SNMP agent. You can choose to specify one or more community name-related features: Define MIB views of all the accessible MIB subsets. Define the read-only or read-write access mode of the community name to the MIB. The community with read-only authority can only query the device information, whereas the community with read-write authority can also configure the device. Perform the following configuration in system view: 1-3

5 Set the community name and the access authority Remove the community name and the access authority snmp-agent community { read write } community-name [ [ mib-view-view-name ] [ acl acl-list ] ] undo snmp-agent community community-name Setting the System Information System information includes the ID and the contact method of the administrator, the location of the switch and the version of the SNMP. The ID and the contact method of the administrator is a character string describing the contact information used for the system maintenance. Through this information, the device maintenance staffs can obtain the manufacturer information of the device so as to contact the manufacturer in case the device is in trouble. You can use the following command to set the contact information. The location information of the switch is a management variable of the system group in MIB, which represents the location of the managed device. Perform the following configuration in system view: Set the system information Restore the default information snmp-agent sys-info { contact syscontact location syslocation version { { v1 v2c v3 }* all } } undo snmp-agent sys-info { { contact location }* version { { v1 v2c v3 }* all } } By default, the contact information for system maintenance is "Hangzhou H3C Technologies Co., Ltd.", the physical location information is " Hangzhou, China", and the version is SNMPv1, SNMPv2c, and SNMPv Enabling SNMP Agent to Send Traps The managed device transmits traps without request to the Network Management Station to report some critical and urgent events (such as restart). You can use the following commands to enable or disable the managed device to send trap messages. Perform the following configuration in corresponding views. 1-4

6 Enable the sending of trap (system view) Disable the sending of trap (system view) Enable the switch ports to send SNMP trap messages (Ethernet port view or VLAN interface view) Disable the switch port to send SNMP trap messages (Ethernet port view or VLAN interface view) snmp-agent trap enable [ bgp [ backwardtransition established ]* configuration flash ospf [ process-id ] [ ospf-trap-list ] protect-switch pw ldp lsp mpls-oam standard [ authentication coldstart linkdown linkup warmstart ]* system vrrp [ authfailure newmaster ] ] undo snmp-agent trap enable [ bgp [ backwardtransition established ]* configuration flash ospf [ process-id ] [ ospf-trap-list ] protect-switch pw ldp lsp mpls-oam standard [ authentication coldstart linkdown linkup warmstart ]* system vrrp [ authfailure newmaster ] ] enable snmp trap updown undo enable snmp trap updown By default, the current port or VLAN interface sends trap messages Setting the Destination Address of Trap You can use the following commands to set or delete the destination address of the trap. Set the destination address of trap Delete the destination address of trap snmp-agent target-host trap address udp-domain host-addr [ udp-port udp-port-number ] params securityname securityname [ v1 v2c v3 [ authentication privacy ] ] undo snmp-agent target-host host-addr securityname securityname 1-5

7 1.2.5 Setting Lifetime of Trap Message You can use the following command to set lifetime of Trap message. Trap message that exists longer than the set lifetime will be dropped. Set lifetime of Trap message Restore lifetime of Trap message snmp-agent trap life seconds undo snmp-agent trap life By default, the lifetime of Trap message is 120 seconds Setting the Engine ID of a Local Device You can use the following commands to set the engine ID of a local device. Set the engine ID of the device Restore the default engine ID of the device. snmp-agent local-engineid engineid undo snmp-agent local-engineid The engine ID of the device can be IP address, MAC address or self-defined text. It defaults to the enterprise number + the device information Setting an SNMP Group You can use the following commands to set or delete an SNMP group. Set an SNMP group Delete an SNMP group snmp-agent group { v1 v2c } group-name [ read-view read-view ] [ write-view write-view ] [ notify-view notify-view ] [ acl acl-list ] snmp-agent group v3 group-name [ authentication privacy ] [ read-view read-view ] [ write-view write-view ] [notify-view notify-view ] [ acl acl-list ] undo snmp-agent group { v1 v2c } group-name undo snmp-agent group v3 group-name [ authentication privacy ] 1-6

8 1.2.8 Setting the Source Address of Trap You can use the following commands to set or remove the source address of the trap. Set the Source Address of Trap Remove the source address of trap snmp-agent trap source interface-type interface-number undo snmp-agent trap source Adding a User to an SNMP Group You can use the following commands to add or delete a user to/from an SNMP group. Add a user to an SNMP group Delete a user from an SNMP group snmp-agent usm-user { v1 v2c } username groupname [ acl acl-list ] snmp-agent usm-user v3 username groupname [ authentication-mode { md5 sha } authpassstring [ privacy-mode { des56 privpassstring } ] ] [ acl acl-list ] undo snmp-agent usm-user { v1 v2c } username groupname undo snmp-agent usm-user v3 username groupname { local engineid engine-id } You must first configure the SNMP engine ID before configuring the remote user for an agent, because the engine ID is required during the authentication. If you forget to configure the engine ID before adding a user, the operation of adding this user will fail. For SNMPv1 and v2c, this operation is adding a new community name, while for SNMPv3, this operation is adding a user for an SNMP group Creating/Updating View Information You can specify the view to control the access to the MIB by SNMP manager. You can use either the predefined views or the self-defined views. You can use the following commands to create, update the information of views or delete a view. Create/Update view information snmp-agent mib-view { included excluded } view-name oid-tree 1-7

9 Delete a view undo snmp-agent mib-view view-name Setting the Size of the SNMP Packet Sent/Received by an Agent You can use the following commands to set the size of SNMP packet sent/received by an agent. Set the size of the SNMP packet sent/received by an agent Restore the default size of the SNMP packet sent/received by an agent snmp-agent packet max-size byte-count undo snmp-agent packet max-size The agent can receive/send the SNMP packets of the sizes ranging from 484 to 17940, measured in bytes. By default, the size of an SNMP packet is 2000 bytes Disabling SNMP Agent To disable SNMP Agent, perform the following configuration in system view. Disable SNMP agent undo snmp-agent If users disable SNMP Agent, it will be enabled whatever snmp-agent command is configured thereafter Extending the Standard linkup/linkdown Traps Follow these steps to extend the stand linkup/down traps: Remarks Extend the standard linkup/linkdown traps Disable the extension of the standard linkup/linkdown traps snmp-agent trap ifmib link extended undo snmp-agent trap ifmib link extended Available in system view Available in system view 1-8

10 After this command is configured, an extended linkup/linkdown trap is the standard linkup/linkdown trap defined in RFC appended with the interface description and interface type information. Caution: Not all NMSs can process the extended trap messages correctly. By default, the device sends traps whose format is consistent with that defined in the standard IF-MIB. This command is available only when the NMS used supports the extended trap. 1.3 Displaying and Debugging SNMP Remarks Display the statistics information about SNMP packets Display the engine ID of the active device Display the group name, the security mode, the states for all types of views, and the storage mode of each group of the switch. Display SNMP user information in the group user table Display the current community name Display the current MIB view Display the contact character strings, location character strings, and the SNMP version of the system display snmp-agent statistics display snmp-agent local-engineid display snmp-agent group [ group-name ] display snmp-agent usm-user [ engineid engineid group groupname username username ]* display snmp-agent community [ read write ] display snmp-agent mib-view [ exclude include { viewname mib-view } ] display snmp-agent sys-info [ contact location version ]* Available in any view Available in any view Available in any view Available in any view Available in any view Available in any view Available in any view 1-9

11 1.4 SNMP Configuration Examples Common SNMP Configuration Example I. Network requirements Network Management Station and the switch are connected through the Ethernet. The IP address of Network Management Station is and that of the VLAN interface on the switch is Perform the following configurations on the switch: setting the community name and access authority, administrator ID, contact and switch location, and enabling the switch to send trap packets. II. Network diagram Figure 1-2 Network diagram for SNMP configuration III. Configuration procedure # Enter the system view. <H3C> system-view # Set the community name, group and user. [H3C] snmp-agent sys-info version all [H3C] snmp-agent community read public [H3C] snmp-agent mib include internet [H3C] snmp-agent group v3 managev3group write internet [H3C] snmp-agent usm v3 managev3user managev3group # Set VLAN-interface 2 as the interface for network management. Add port GigabitEthernet 2/1/3 to VLAN 2. This port will be used for network management. Set the IP address of VLAN-interface 2 as [H3C] vlan 2 [H3C-vlan2] port gigabitethernet 2/1/3 [H3C-vlan2] interface vlan 2 [H3C-Vlan-interface2] ip address # Enable SNMP agent to send the trap to network management station whose IP address is The SNMP community is public. [H3C] snmp-agent trap enable standard authentication [H3C] snmp-agent trap enable standard coldstart [H3C] snmp-agent trap enable standard linkup [H3C] snmp-agent trap enable standard linkdown 1-10

12 [H3C] snmp-agent target-host trap address udp-domain udp-port 5000 params securityname public # Configure network management system The PC on which the network management resides requires for login configuration. As for Mib-Browser, the login configuration is as follows: SNMPv1/v2c logs in using the default community name public, and the SNMPv3 logs in using managev3user. The switch supports imanager Quidview NMS. Users can query and configure the switch through the network management system. For details, see the manuals for the network management products Configuration Example for Private Network Support I. Network requirements As shown in Figure 1-3, the VLAN to which PC belongs is in a private network. You manage the switches S9500A and S9500B using the network management software Quidview on PC; S9500A acts as a host. On S9500A, configure a static route to PC in the public network, and configure the static routes to the loopback interface and other devices to be managed in the private network; On S9500B, configure the routes to PC and the loopback interface on S9500A through a routing protocol or configure the static routes to them; It is required to implement: PC can manage S9500A and S9500B through SNMP in the private network. II. Network diagram Figure 1-3 Network diagram for SNMP private network support III. Configuration procedure 1) Configure S9500A # Configure the loopback interface and a VLAN interface. <S9500A> system-view [S9500A] interface loopback 0 [S9500A-LoopBack0] ip address

13 [S9500A-LoopBack0] quit [S9500A] vlan 10 [S9500A-vlan10] port Ethernet 3/1/2 [S9500A-vlan10] interface vlan-interface 10 [S9500A-Vlan-interface10] ip address [S9500A-Vlan-interface10] quit # Create a VPN instance, create a VLAN and bind it with the private network. [S9500A] ip vpn-instance vpna [S9500A-vpn-vpna] route-distinguisher 100:1 [S9500A-vpn-vpna] vpn-target 100:1 both [S9500A-vpn-vpna] quit [S9500A] vlan 172 [S9500A-vlan172] port Ethernet 3/1/1 [S9500A-vlan172] interface vlan-interface 172 [S9500A-Vlan-interface172] ip binding vpn-instance vpna [S9500A-Vlan-interface172] ip address [S9500A-Vlan-interface172] quit # Configure static routes. [S9500A] ip route-static vpn-instance vpna preference 1 [S9500A] ip route-static vpn-instance vpna public preference 1 [S9500A] ip route-static vpn-instance vpna public preference 1 # Configure SNMP, and set the trap source address. [S9500A] snmp-agent [S9500A] snmp-agent local-engineid DB000FE21E [S9500A] snmp-agent community write private [S9500A] snmp-agent community read public [S9500A] snmp-agent sys-info version all [S9500A] snmp-agent target-host trap address udp-domain params securityname public [S9500A] snmp-agent trap enable ldp [S9500A] snmp-agent trap enable configuration [S9500A] snmp-agent trap enable system [S9500A] snmp-agent trap enable standard [S9500A] snmp-agent trap enable lsp [S9500A] snmp-agent trap enable vrrp [S9500A] snmp-agent trap enable ospf [S9500A] snmp-agent trap enable bgp [S9500A] snmp-agent trap enable flash 1-12

14 [S9500A] snmp-agent trap source LoopBack0 2) Configure S9500B # Configure the loopback interface and a VLAN interface. <S9500B> system-view [S9500B] interface loopback 0 [S9500B-LoopBack0] ip address [S9500B-LoopBack0] quit [S9500B] vlan 10 [S9500B-vlan10] port Ethernet 2/1/1 [S9500B-vlan10] interface vlan-interface 10 [S9500B-Vlan-interface10] ip address [S9500B-Vlan-interface10] quit # Configure the static routes to S9500A and PC. [S9500B] ip route-static preference 1 [S9500B] ip route-static preference 1 # Configure SNMP, and set the trap source address. [S9500B] snmp-agent [S9500B] snmp-agent local-engineid DB000FE21E [S9500B] snmp-agent community write private [S9500B] snmp-agent community read public [S9500B] snmp-agent sys-info version all [S9500B] snmp-agent target-host trap address udp-domain params securityname public [S9500B] snmp-agent trap enable ldp [S9500B] snmp-agent trap enable configuration [S9500B] snmp-agent trap enable system [S9500B] snmp-agent trap enable standard [S9500B] snmp-agent trap enable lsp [S9500B] snmp-agent trap enable vrrp [S9500B] snmp-agent trap enable ospf [S9500B] snmp-agent trap enable bgp [S9500B] snmp-agent trap enable flash [S9500B] snmp-agent trap source LoopBack0 1-13