Remote Monitoring with SNMP

[obaroikoh]

Hello House,

I have a couple of devices I want to monitor remotely using Solarwinds or PRTG. I need to configure SNMP to get it to work but don't know How.

I tried the following commings but it didn't work

access-list 100 permit udp any eq snmp destination address destination wildcard

snmp-server community string rw

After doing that, I keep getting unable to open socket on port 161. 

How do i go about this. I need help please.

Thanks

[Julio Garcia]

Hi, 

where is the ACL applied? Can you post the relevant configuration and the output of "show snmp"?

Regards,

Julio

[obaroikoh]

Hello Julio,

Thanks for the message. The thing is I've not configured SNMP before. I read somewhere how to do it but while trying it on GNS3, it wasn't working. I don't want to try it on a live device which was why I used GNS3. 

This is what i want to achieve with the whole project.

I want to be able to monitor Bandwidth/Traffic flow in and out of the remote network.

My options with PRTG are NetFlow and SNMP. I think I'd be fine with SNMP for now. 

I'd appreciate it if you can help me out with this.

Thanks in anticipation

[Julio Garcia]

Hi,

enabling snmp in a live device is not going to create any problem or disruption in your network, 

Enabling SNMP is as straight as creating the community string, but I suggest you use a ReadOnly community so you cannot do changes in your devices with SNMP:

snmp-server community <community> RO

You can, as an option, associate an ACL to that command to filter the SNMP access to your device:

snmp-server community <community> RO 10

access-list 10 permit X.X.X.X

Then, optionally,  you can enable the device to send traps to your SNMP host (PRTG server):

snmp-server host <PRTG server IP> <community> <type of traps>

And also enable the generation of traps:

snmp-server enable traps <list of traps>

The list of traps is quite big and you should check it in the Cisco SNMP documentation. Maybe you don't need traps at all. Let me know and we can go further on this topic.

Ensure you have IP connectivity between your PRTG server and the management IP of the devices. If you do, add the SNMP sensor in PRTG and configure it with the management IP and the RO community of your device. It should detect your device.

Let me know if it works.

regards,

Julio

[obaroikoh]

Hello Julio,

Thanks once again for your message. I'm so sorry for the late reply. I appreciate your willingness to help me.

Just so We're sure I'm doing the right thing, I'm going to show you my proposed configuration.

snmp-server community private ro 10

access-list 10 permit 10.10.10.10 ( The destination address where PRTG is. It is a remote location. In the cloud actually.)

snmp-server host 10.10.10.10 public snmp

snmp-server enable traps snmp

I've been going through the traps and I'm not sure which would be appropriate for sending bandwidth/traffic information.

Thanks so much Julio

Obaro

[obaroikoh]

Hello Julio,

I tried the above commands but i kept getting device does not support require uptime oid. I was thinking if it would be possible to use NetFlow instead. Below is the config i want to use.

int fo/1 

ip route-cache flow

exit

ip flow-export destination 10.10.10.1 20

ip flow-export version 9

exit

Let me know if I'm on track. And if it wont alter anything in the device.

Thanks so much

[Julio Garcia · Accepted solution]

Hi obaroikoh,

The first thing you should do is to debug snmp packets in your Cisco device and try to add the sensor in PRTG, you should see the packet incoming to your Cisco device from the PRTG server IP:

Dec  4 10:28:42.109: SW1: SNMP: Packet received via UDP from 10.11.11.121 on Port-channel3

This debug, if you are not using SNMP apart form this, it's not dangerous, but be sure that you only apply this one ( "debug snmp packets"). This will confirm that the Cisco device is receiving the SNMP request from PRTG.

As an alternative, Paessler offers a free tool called snmptester (http://www.paessler.com/tools/snmptester) that you can install and then check the SNMP connectivity from your server.

I tried to add myself the SNMP Traffic sensor (I assume you are using that one in PRTG) and didn't work at first but I found a workaround:

-In the device settings in PRTG, go to SNMP COMPATIBILITY OPTIONS and change to 32-bit counters. Save

-Add the SNMP Traffic sensor. Now it should recognize your device and list all the interfaces. select the interfaces you want to monitor.

-Change back to 64bit counters in the compatibility options.

Anyway, PRTG is probably not the best tool to SNMP monitor your devices, and also it uses one sensor per monitored interface. Your free license only includes 100 sensor, so it's not very scalable one you have a decent amount of devices and interface. I suggest Cacti + Weathermaps for bandwidth monitoring with SNMP. PRTG is not bad for Netflow though. The Netflow configuration you posted should be fine, but depending on the platform and IOS it may need some tweaking. Which platform are you working with?

Regards,

Julio

[obaroikoh]

Hi Julio

I'm so frsutrated right becuase nothing seems to be working for me.

I made the changes to my settings and nothing worked. I working with a Cisco 1941 router running IOS 15.1

I will look at Cacti + Weathermaps as you suggested.

Meanwhile How do i tweak the Netflow config to work for me and what other sensor can I use for SNMP moonitoring since SNMP Traffic isn't working for me.

I enabled SNMP debugging but I can't check to know if it's receiving SNMP Packets.

Thanks Julio

[Julio Garcia]

OK, let's do it step by step. Let's focus on SNMP first:

-Remove the ACL from the "snmp-server community" command so you don't block any SNMP traffic for the moment. Once everything is working, then you can lock it down again.

-Ping the device from the PRTG server. Is that working? If so, move on to the next step

-In your server, download the snmptester from Paessler website and run it:

        Local IP : the IP of your server

        Device IP/Port : your Cisco1941 management IP and port 161

        SNMP Version: SNMP V2c

        Community: should be the one you configured in your "snmp-server community" command

        Select Scan Interfaces in the Request Type and then Run Test.

This should give you a bunch of information about all your router interfaces.

Let me know the results of this test.

BTW, in order to see the debugged traffic in the router, you must enable "terminal monitor" (from EXEC mode ) or "console logging" (from CONFIG mode). Don't forget to disable any debug after you have checked what you need ("undebug all")

Regards,

Julio

[obaroikoh]

Hi Julio,

I remove access-list and scanned with the tester. It worked. I got lots of information.

And i can  also ping the device from the PRTG server.

What do i no next?

[obaroikoh]

I've gotten SNMP traffic to work. You're a life saver Julio. 

Now i just have to make Netflow work.

How do i go about it?

I owe you one Julio

[Julio Garcia]

I'm glad the SNMP is working for you.

What's the complete version you are using? And which license? ipbase, ipservices...we have to check if your device/IOS supports Netflow or Flexible Netflow. The configuration changes from one to the other.

Julio

[obaroikoh]

I'm using IOS version 15.1(4)M4.

ipbase (ipbasek9) license.

Thanks so much

[Boris Krajnc]

I can recommend new network monitoring tool - SmartSNO which supports SNMP, syslog..... Netflow will be implemented in near future. Of course, it is vendor independent monitoring software. You can download FREE version from www.smartsno.com

Boris