SNMP#

You will end up with the router answering SNMP for one monitoring system and nobody else. Use this when you already have something that speaks SNMP; if you are choosing, Prometheus gives you more about this product specifically.

Before you start#

The operator role and a licence.
The monitoring system's address or network.
A community string you generated rather than chose. openssl rand -hex 12.

Step 1 — Add the community#

System → Settings → SNMP.

set service snmp community <the string> authorization ro
set service snmp community <the string> network 192.0.2.60/32
set service snmp location 'rack 3'
set service snmp contact 'net-ops'

The panel has a read-write checkbox. Leave it off. A read-write community is a configuration channel that bypasses the Commit Bar, the audit log and every role check in this product.

network may be repeated for several sources. Scope it as tightly as you can — a /32 for one collector.

Step 2 — Let the collector in#

set firewall ipv4 input filter rule 120 action accept
set firewall ipv4 input filter rule 120 description 'snmp from the collector'
set firewall ipv4 input filter rule 120 protocol udp
set firewall ipv4 input filter rule 120 destination port 161
set firewall ipv4 input filter rule 120 source address 192.0.2.60/32

Check it worked#

From the collector:

bash

snmpwalk -v2c -c <the string> 192.0.2.1 system
snmpget -v2c -c <the string> 192.0.2.1 IF-MIB::ifDescr

And from anywhere else, confirm it does not answer:

bash

snmpwalk -v2c -c <the string> 203.0.113.2 system

Undoing it#

delete service snmp community <the string>

or all of it, which the panel's Turn SNMP off stages:

delete service snmp

Remove the firewall rule too.