LMS 3.2.1 integration with Clarity NMS for snmp trap forwarding

[kmong]

Our client have integrated Clarity NMS to Ciscoworks LMS 3.2.1. So far they are receiving raw alarms/snmp traps but it lacks information/inventory of the originating device. Kindly see sample raw alarms below:

2420: 2011-11-25 12:10:46 Received trap ==> Received SNMPv1 Trap

Community=ciscoworks

Enterprise=1.3.6.1.6.3.1.1.5

Generip trap type=2

Specific Trap Type=0

Trap From=10.220.10.1

Trap ID=1.3.6.1.6.3.1.1.5.2

Trap Time=-1436283373

1.3.6.1.2.1.2.2.1.1.83=83

1.3.6.1.2.1.2.2.1.2.83=GigabitEthernet1/40

1.3.6.1.2.1.2.2.1.3.83=6

1.3.6.1.4.1.9.2.2.1.1.20.83=Lost Carrier

EndTrap

10933: 2011-11-24 11:57:53 Received trap ==> Received SNMPv1 Trap

Community=ciscoworks

Enterprise=1.3.6.1.4.1.9.1.291

Generip trap type=2

Specific Trap Type=0

Trap From=10.220.10.1

Trap ID=1.3.6.1.4.1.9.1.291.2

Trap Time=1628056965

1.3.6.1.2.1.2.2.1.1.8=8

1.3.6.1.2.1.2.2.1.2.8=E1 0/0/0

1.3.6.1.2.1.2.2.1.3.8=18

EndTrap

--

As you can see, those raw alarms doesn’t contain any information about the originating equipment or the physical card, port related information where those alarms were generated. Instead those alarms received are just NMS level alarms.

How do we resolve this so that the inventory of the equipment would be part of the trap to be received by Clarity from Ciscoworks.

[ngoldwat]

Hi,

Is the issue you have the source IP address of the forwarded trap?  Per RFC it is the IP of the actual device sending the trap.  The originating IP should be contained within the packet. I have included some additional information you may find helpful.

Q. What is the difference between SNMP Raw Trap Forwarding and SNMP Trap alert/event Trap Forwarding? Does DFM support both?

A. You can configure raw trap forwarding at DFM > Other configuration > SNMP Trap forwarding, and processed event/alert trap forwarding at DFM > Notification Services > SNMP Trap Forwarding. Processed trap is "when DFM receives certain SNMP traps, it analyzes the data found in fields (Enterprise/Generic trap identifier/Specific Trap identifier/variable−bindings) of each SNMP trap message, and changes the property value of the object property (if required)". Raw trap is the trap that the device forwards to DFM and DFM has yet to process it. For more information, refer to the DFM User Guide. Yes, DFM supports both ways of trap forwarding.

http://www.cisco.com/en/US/products/sw/cscowork/ps2421/products_qanda_item09186a0080a9b35b.shtml

DFM will only forward SNMP traps from devices in the DFM inventory. It will not change the trap format—it will forward the raw trap in the format in which the trap was received from the device. However, you must enable SNMP on your devices and you must do one of the following:

• Configure SNMP to send traps directly to DFM
• Integrate SNMP trap receiving with an NMS or a trap daemon

The versions of SNMP traps supported by DFM are described in SNMP and ICMP Polling. For information on forwarding processed and pass-through traps, see Processed and Pass-Through Traps, and Unidentified Traps and Events.

Pass-through traps are traps that DFM receives from devices that are not in the DFM inventory, and DFM has not processed. Forwarding these traps is controlled using Configuration > Other Configurations > SNMP Trap Forwarding. These traps are shown in the Alerts and Activities display because of their relevance to fault monitoring. Pass-through traps are displayed as follows:

• As one of the following events:

> InformAlarm

> MinorAlarm

> MajorAlarm

• With the device type and the device name from which it was generated.

If DFM does not know which device generated the trap, it ignores the trap. Pass-through traps will be cleared after a default interval of 10 minutes to one hour

http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_device_fault_manager/3.2/user/guide/dfm32ug_Book.html

[kmong]

Thanks for the info. Do you have samples of traps received from DFM showing that it really does include the device type and device name from which it was generated. Is it possible to include the inventory details aside from the device type (i.e. chassis, card no.)