SNMP Management with MRTG

[mike-greene]

I am trying to get the bandwidth utilization off the serial interface of a 1700 router running IOS 12.1.(8c). I want to do this remotely because I am in on state and the router is in another. In the past, I have used MRTG to monitor traffic off the Ethernet interface (while I was on the local LAN) with no problem. I have always just put a community string with RO rights and MRTG is able to pick the information up. Are you not able to monitor SNMP traffic remotely using MRTG?? I have tried to monitor the serial and the fastethernet interface from my desk but I get a “no response” error from MRTG. MRTG says this error is due to an invalid community string but I have verified this and it is correct. Any ideas or is this just plain stupidity on my part??

Thanks in advance..

[rmushtaq]

Your MRTG cfg file could have problems, you may want to check the syntax etc. There may be a access-list on the device blocking the SNMP request. Also, you can poll your router using any CLI SNMPWalk utilities like (UCD-SNMP which is a free ware) to see if the router responds to the SNMP polls or not. You only need to have the RO string on the router to poll it with SNMP. You can also turn on debug snmp packet on the router to see exactly what's going on and whether the router is receiving the SNMP requestes or not. It give much more details. But turning on debugs on a production router could spike the CPU, use with caution.

[cwu]

The access-list blocking SNMP may not be on the device itself - it may be somewhere between you and the device you're trying to monitor.

I know what you're trying to do is possible because I've done it many times myself. MRTG doesn't care how you're accessing the device.

[mike-greene]

Thanks for the response....

The router it self is just a plain config, no access lists on it. When you enable snmp on the router (I'm assuming with the snmp-server command) should I be able to port scan the serial interface and get an open port that snmp may be listening on?? The router is some 20 hops from where I'm at, and most of those hops are probably backbone router's, so the chances of me calling at&t or someone and asking them remove an access list is not going to happen. So if thats the case I'm probably stuck with the providers 24 hour snap-shot monitoring tool.

Thanks for all your help...

[rmushtaq]

SNMP uses the standard ports 161 for SNMP Polling and 162 Traps. You don't need to open any port on the router itself.