Problems with SNMP and EEM

[aaronpecora]

                   I am generating traps via SNMPSoft's snmptrapgen.exe and sending traps to my 2811 router. Using an EEM applet I am trying to receive the trap and have an action produce.

I have the SNMP trap contain sysContact with alice and in the the trap OID WarmStart. My EEM is checking for the sysContact OID and comparing to

event manager applet SNMP_TRAP

event snmp-notification oid 1.3.6.1.2.1.1.4.0 oid-val "alice" op eq src-ip-address 1.1.3.1

action 1.0 syslog priority informational msg "Trap received"

However I get a no_match during debug.

I have a feeling that some configuration commands may be missing on the router for setting up SNMP, I have only SNMP manager and a shard community string.

I will post my actual configs shortly

[Joe Clarke]

What version of IOS?  Can you post a sniffer trace of the trap?  Can you try to match on an integer varbind instead?

[aaronpecora]

Here is the TRAP GENERATION:

C:\>SnmpTrapGen.exe -r:1.1.3.1 -v:2c -to:1.3.6.1.6.3.1.1.5.2.0 -eo:1.3.6.1.6.3.1.1.5.2.0 -vid:1.3.1.2.1.1.4.0 -val:'alice' -vtp:str

Here is the CONFIGs/Version on the router:

Cisco IOS Software, 2800 Software (C2800NM-ADVENTERPRISEK9-M), Version 15.1(4)M2, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2011 by Cisco Systems, Inc.
Compiled Mon 26-Sep-11 16:41 by prod_rel_team

ROM: System Bootstrap, Version 12.4(13r)T, RELEASE SOFTWARE (fc1)

snmp-server community public RO
snmp-server community private RW
snmp-server contact alice
snmp-server manager

The Applet

2    applet    user    snmp_notification   Off   Tue Aug 21 17:47:52 2012  SNMP_TRAP
oid {1.3.6.1.2.1.1.4.0} oid-val {alice} op eq src-ip-address 1.1.3.3
maxrun 20.000
action 1.0 syslog priority informational msg "TRAP RECEIVED"

From Debug of SNMP-NOTIFICATION:
*Aug 21 17:55:55.179: fh_fd_snmp_proxy_incoming_trap_msgs: incoming snmp pdu received
*Aug 21 17:55:55.179: fh_fd_snmp_proxy_incoming_trap_msgs:varbind_buff=1.3.6.1.2.1.1.3.0 eventsp_oid=1.3.6.1.2.1.1.4.0
*Aug 21 17:55:55.179: fh_fd_snmp_proxy_incoming_trap_msgs:varbind_buff=1.3.6.1.6.3.1.1.4.1.0 eventsp_oid=1.3.6.1.2.1.1.4.0
*Aug 21 17:55:55.179: fh_fd_snmp_proxy_incoming_trap_msgs:varbind_buff=1.3.1.2.1.1.4.0 eventsp_oid=1.3.6.1.2.1.1.4.0
*Aug 21 17:55:55.179: fh_fd_snmp_proxy_incoming_trap_msgs: trap received NO match src ip addr 1.1.3.3 dest I/F FastEthernet0/1, dest ip address 1.1.3.1

[Joe Clarke · Accepted solution]

You don't appear to be using the src-ip-address option correctly.  That should be the IP address of your

SNMPSoft machine, not the router itself.

[aaronpecora]

Had more errors than that, I fixed that, also another issue was the value 'alice' I was passing, did not need single quotes. That was an issue as well. Thanks.