SNMP#

You will end up with the router answering SNMP for one monitoring system and nobody else. Use this when you already have something that speaks SNMP; if you are choosing, Prometheus gives you more about this product specifically.

Before you start#

• The Operator role, and a licence: SNMP is part of the router's configuration.
• The monitoring system's address or network.
• A choice between an SNMPv3 user and a community. SNMPv3 authenticates the monitoring system and encrypts what it reads; a community (SNMPv1 and v2c) is a password sent in the clear. Use SNMPv3 if the monitoring system supports it.

Step 1 — Add an SNMPv3 user#

System → Settings tab → SNMP. While SNMP is off, the panel says "SNMP is off" and "Add a community or an SNMPv3 user to turn it on." Choose Add SNMPv3 user.

Both passwords are required: the router refuses an SNMPv3 user without authentication and privacy. They are written to the router and never shown again. A user's panel asks for a new one only to change it: "Leave empty to keep the current password." Changing the algorithm or the encryption needs a new password as well.

Add user adds "Add SNMPv3 user “monitor”" to the pending changes, with "Read-only, SHA authentication, AES privacy" beneath it. For the first user, the page also adds what the router needs before any user can exist: a random engine ID ("Set the SNMPv3 engine ID to …"), a group for the access level ("Add SNMPv3 group “readonly”") and a view of everything ("Add SNMPv3 view “all”"). The engine ID can be changed later in SNMP settings.

Or add a community#

If the monitoring system speaks only SNMPv1 or v2c, choose Add community. Generate the community rather than choosing it — openssl rand -hex 12.

"Anywhere when neither list has an entry." Scope it as tightly as you can — a /32 for one collector.

Add community adds "Add an SNMP community" to the pending changes, with "Read-only, from 192.0.2.60/32" beneath it. The sentence never names the community itself.

Read-write lets anything holding the community change settings over SNMP, outside the pending changes, the audit log and every role check in this product.

Step 2 — Say where the router is#

Once SNMP is on, Edit beside Location and Contact opens SNMP settings: Location (such as Rack 2), Contact (such as noc@example.com) and Engine ID ("Identifies the router to SNMPv3 clients. Set when the first SNMPv3 user is added."). Choose Save changes.

Step 3 — Apply#

Apply the pending changes from the bar at the bottom of the page with Apply changes. The SNMP panel then shows On, with the user or community in its table.

Step 4 — Let the collector in#

The firewall the installer writes accepts everything that arrives on the LAN interface, so a collector on the LAN is already let in. For a collector anywhere else, add a rule on the Firewall page: ruleset input, action accept, protocol udp, the collector as the source address (such as 192.0.2.60/32), destination port 161, and a description.

Check it worked#

From the collector, with SNMPv3:

snmpwalk -v3 -l authPriv -u monitor -a SHA -A '<authentication password>' \
  -x AES -X '<privacy password>' 192.0.2.1 system

or with a community:

snmpwalk -v2c -c <the community> 192.0.2.1 system
snmpget -v2c -c <the community> 192.0.2.1 IF-MIB::ifDescr.1

And from anywhere else, confirm it does not answer:

snmpwalk -v2c -c <the community> 203.0.113.2 system

Undoing it#

Click a user or a community, choose Delete user or Delete community, and apply. Or all of it: Turn off SNMP, which asks "Turn off SNMP?" and then adds "Turn off SNMP" to the pending changes — the communities, the users, the engine ID, the location and the contact all go when it is applied.

Remove the firewall rule too.

In Advanced mode#

With Advanced mode on (Account → Preferences), Review changes lists these changes as the router's commands, under service snmp.

See also#

• Scrape the agent — richer, for this product
• Ship logs off the box
• Harden a router that faces the internet
• System — settings