WEBVTT 1 00:00.000 --> 00:06.210 SNMP is a fairly sizable topic, and our focus needs to be on how we end up 2 00:06.210 --> 00:06.840 deploying this 3 00:06.840 --> 00:10.980 into our networks rather than necessarily the nitty-gritty of how it all comes 4 00:10.980 --> 00:11.760 together. 5 00:11.760 --> 00:14.880 But it's still useful for us to know exactly how it works. 6 00:14.880 --> 00:19.080 A simple network management protocol is what it stands for, typically not 7 00:19.080 --> 00:19.960 viewed as very 8 00:19.960 --> 00:25.810 simple, which is why these days SNMP is getting phased out in favor of APIs and 9 00:25.810 --> 00:26.620 systems that 10 00:26.620 --> 00:27.620 leverage them. 11 00:27.620 --> 00:30.760 However, it is still actively deployed today. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 11 00:27.620 --> 00:30.760 However, it is still actively deployed today. 12 00:30.760 --> 00:35.680 SNMP is intended to allow us to do automated remote management. 13 00:35.680 --> 00:42.080 For example, it can get configuration information or statistical information or 14 00:42.080 --> 00:43.280 just data from 15 00:43.280 --> 00:44.440 a device. 16 00:44.440 --> 00:51.430 We can also set configuration so I could configure a device to change, maybe it 17 00:51.430 --> 00:52.480 's, I don't know, 18 00:52.480 --> 00:57.660 cost on a network link to balance, to do better load balancing, it could change 19 00:57.660 --> 00:59.080 access point, 20 00:59.080 --> 01:03.860 transmit power, those kinds of things, and it can also importantly be used to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 20 00:59.080 --> 01:03.860 transmit power, those kinds of things, and it can also importantly be used to 21 01:03.860 --> 01:04.840 send alerts, 22 01:04.840 --> 01:07.880 usually via what's known as traps. 23 01:07.880 --> 01:10.820 So it's a trap joke, but it's a trap. 24 01:10.820 --> 01:15.290 It's going to trigger an alert and allow us to proactively understand that 25 01:15.290 --> 01:16.160 something is 26 01:16.160 --> 01:17.960 happening on our network. 27 01:17.960 --> 01:24.480 Now SNMP has a specific framework for how it comes together. 28 01:24.480 --> 01:29.080 And it's typically going to be run by something called a network management 29 01:29.080 --> 01:30.360 system or a network WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 29 01:29.080 --> 01:30.360 system or a network 30 01:30.360 --> 01:34.640 management station, just depending on how you interpret NMS. 31 01:34.640 --> 01:39.190 But the idea here is typically we're going to use a software package on our 32 01:39.190 --> 01:39.960 network, 33 01:39.960 --> 01:44.560 which is going to be at the heart of our SNMP operation. 34 01:44.560 --> 01:49.520 One of the reasons why we rely so heavily on this is because SNMP again is not 35 01:49.520 --> 01:50.240 simple, 36 01:50.240 --> 01:52.280 it is fairly complex. 37 01:52.280 --> 01:57.310 The way it comes together is we have a network device like a router or a switch 38 01:57.310 --> 01:57.560 , and these 39 01:57.560 --> 02:01.080 are going to run an SNMP agent. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 39 01:57.560 --> 02:01.080 are going to run an SNMP agent. 40 02:01.080 --> 02:06.120 Now this is not an agent we have to install with Cisco, it's integrated into 41 02:06.120 --> 02:06.720 iOS XE, 42 02:06.720 --> 02:11.960 but at the same time the agent is running there on the network device. 43 02:11.960 --> 02:18.360 On this system there's going to be a management information base or a MIB. 44 02:18.360 --> 02:22.720 And this is going to define the SNMP capabilities of the system. 45 02:22.720 --> 02:28.300 This is a tree of variables and data points that are known as object 46 02:28.300 --> 02:31.360 identifiers or OIDs. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 46 02:28.300 --> 02:31.360 identifiers or OIDs. 47 02:31.360 --> 02:33.600 These are not particularly human readable. 48 02:33.600 --> 02:36.800 It's just a long string of numbers. 49 02:36.800 --> 02:41.720 And this is again where some of the simplicity we see doesn't actually exist. 50 02:41.720 --> 02:47.370 But the idea here is that we're going to use these identifiers to send and 51 02:47.370 --> 02:49.360 receive information 52 02:49.360 --> 02:53.320 from a centralized device, and this is where the NMS comes into play. 53 02:53.320 --> 02:56.950 This is again a software package that we as the admins typically are going to 54 02:56.950 --> 02:57.400 be able 55 02:57.400 --> 02:59.680 to log into. 56 02:59.680 --> 03:02.640 Most commonly, via graphical user interface. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 56 02:59.680 --> 03:02.640 Most commonly, via graphical user interface. 57 03:02.640 --> 03:07.840 And then ideally it also again is able to send us alerts when things aren't 58 03:07.840 --> 03:08.800 quite behaving 59 03:08.800 --> 03:10.000 appropriately. 60 03:10.000 --> 03:15.480 So I could just use this to get alerts, visualize the network status, 61 03:15.480 --> 03:16.880 understand how things are 62 03:16.880 --> 03:17.880 going. 63 03:17.880 --> 03:24.040 But I could also again push configuration down to these devices if I so desire. 64 03:24.040 --> 03:27.050 Maybe just performing a software upgrade would be a good example of something I 65 03:27.050 --> 03:28.200 can do with 66 03:28.200 --> 03:32.960 a centralized NMS using SNMP. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 66 03:28.200 --> 03:32.960 a centralized NMS using SNMP. 67 03:32.960 --> 03:36.440 Now we mentioned these alerts and I already mentioned the concept of traps. 68 03:36.440 --> 03:41.480 But actually there's a different type of trap called an inform. 69 03:41.480 --> 03:44.820 And this is usually what we're actually going to use in our production 70 03:44.820 --> 03:45.800 environments. 71 03:45.800 --> 03:46.960 So let's talk about that. 72 03:46.960 --> 03:52.840 These traps are designed to give us information without asking for it. 73 03:52.840 --> 03:56.400 So typically we're going to say, hey, I want this information and the device 74 03:56.400 --> 03:57.840 responds back. 75 03:57.840 --> 04:02.350 But what if there's something really bad, a little explosion there on this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 75 03:57.840 --> 04:02.350 But what if there's something really bad, a little explosion there on this 76 04:02.350 --> 04:03.080 device? 77 04:03.080 --> 04:04.400 Something bad happened. 78 04:04.400 --> 04:07.400 Well now I want to be proactive. 79 04:07.400 --> 04:10.200 I don't want to have to wait as the network device. 80 04:10.200 --> 04:13.000 I don't want that device to wait for me to ask it what's happening. 81 04:13.000 --> 04:16.760 I want it to send me that proactive alert. 82 04:16.760 --> 04:22.200 However, this device needs to understand what constitutes an emergency that I 83 04:22.200 --> 04:23.080 need to send 84 04:23.080 --> 04:24.200 an alert. 85 04:24.200 --> 04:26.760 So this is a trap and an inform. 86 04:26.760 --> 04:30.400 They both accomplish the same thing just in slightly different ways. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 86 04:26.760 --> 04:30.400 They both accomplish the same thing just in slightly different ways. 87 04:30.400 --> 04:37.120 A trap gets sent without an acknowledgment requirement. 88 04:37.120 --> 04:43.550 Meaning that it's going to send this trap to the NMS, but if it gets lost, an 89 04:43.550 --> 04:44.440 SNMP often 90 04:44.440 --> 04:45.800 runs on UDP. 91 04:45.800 --> 04:50.680 So if it gets lost in transit, then that NMS is not going to receive it. 92 04:50.680 --> 04:56.600 Whereas an inform gets sent with the expectation of an acknowledgment. 93 04:56.600 --> 05:04.200 Meaning that the NMS has to send that acknowledgment back for informs. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 93 04:56.600 --> 05:04.200 Meaning that the NMS has to send that acknowledgment back for informs. 94 05:04.200 --> 05:07.160 And if the device doesn't receive an inform in a certain amount of time, it's 95 05:07.160 --> 05:07.600 going to 96 05:07.600 --> 05:09.720 send that alert again. 97 05:09.720 --> 05:14.530 So informs are actually usually what we want to use for critical situations and 98 05:14.530 --> 05:15.200 critical 99 05:15.200 --> 05:16.200 problems. 100 05:16.200 --> 05:21.710 Whereas traps would be maybe more useful for lighter things that we want to 101 05:21.710 --> 05:22.640 report that 102 05:22.640 --> 05:27.440 don't require as much CPU overhead and generating as much network traffic. 103 05:27.440 --> 05:30.350 But generally speaking, in production networks, it makes sense to set up WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 103 05:27.440 --> 05:30.350 But generally speaking, in production networks, it makes sense to set up 104 05:30.350 --> 05:33.120 informs over traps. 105 05:33.120 --> 05:35.280 So that is our SNMP architecture. 106 05:35.280 --> 05:41.320 Now we need to understand that there are different SNMP versions. 107 05:41.320 --> 05:44.470 And in the modern network, there should really only be one version and yet 108 05:44.470 --> 05:45.120 there are still 109 05:45.120 --> 05:47.720 two versions that we see. 110 05:47.720 --> 05:51.560 Version two C and version three. 111 05:51.560 --> 05:55.370 Version three is what we should absolutely be deploying into our networks 112 05:55.370 --> 05:55.920 anytime we're 113 05:55.920 --> 05:59.480 setting up a new SNMP architecture. 114 05:59.480 --> 06:04.440 And the reason for that is primarily because of security. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 114 05:59.480 --> 06:04.440 And the reason for that is primarily because of security. 115 06:04.440 --> 06:10.640 Version three added much needed security that version two C simply didn't have. 116 06:10.640 --> 06:15.410 And so when we're setting up secure networks, SNMP as we see has a lot of 117 06:15.410 --> 06:17.400 control and capability 118 06:17.400 --> 06:19.400 over what our network is doing. 119 06:19.400 --> 06:24.040 We can get information from it and we can even configure the network via SNMP. 120 06:24.040 --> 06:28.800 If SNMP gets compromised, our networks are in a lot of trouble. 121 06:28.800 --> 06:32.680 And so security should be at the forefront of any conversation where we're WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 121 06:28.800 --> 06:32.680 And so security should be at the forefront of any conversation where we're 122 06:32.680 --> 06:33.320 deploying 123 06:33.320 --> 06:34.920 SNMP. 124 06:34.920 --> 06:39.800 Now that said, version two C is a whole lot more simple. 125 06:39.800 --> 06:44.120 And this is why unfortunately we see a lot of networks going with it. 126 06:44.120 --> 06:48.040 We see network admins setting up version two C because it's simple. 127 06:48.040 --> 06:49.600 We know how to configure it. 128 06:49.600 --> 06:53.010 It's very straightforward, whereas version three is a whole lot more complex to 129 06:53.010 --> 06:54.120 set up. 130 06:54.120 --> 06:56.080 But that's not an excuse. 131 06:56.080 --> 07:00.030 We need to make sure that we take ownership of understanding how version three WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 131 06:56.080 --> 07:00.030 We need to make sure that we take ownership of understanding how version three 132 07:00.030 --> 07:01.640 comes together 133 07:01.640 --> 07:03.800 and what that looks like. 134 07:03.800 --> 07:07.480 So because of version two C being out there so much, let's just spend a few 135 07:07.480 --> 07:08.280 minutes talking 136 07:08.280 --> 07:09.280 about it. 137 07:09.280 --> 07:19.200 So version two C is secured with air quotes because it's not super secured. 138 07:19.200 --> 07:26.080 But it's secured between our NMS and our device out here. 139 07:26.080 --> 07:30.360 And it's going to use what's known as a community string. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 139 07:26.080 --> 07:30.360 And it's going to use what's known as a community string. 140 07:30.360 --> 07:35.790 The community string is supposed to be a password that is shared between the N 141 07:35.790 --> 07:37.160 MS and the device. 142 07:37.160 --> 07:43.170 So only in theory, only the NMS should be able to control and get information 143 07:43.170 --> 07:43.840 from that 144 07:43.840 --> 07:45.560 networking device. 145 07:45.560 --> 07:47.360 Here's the problem. 146 07:47.360 --> 07:51.360 This string is sent in plain text. 147 07:51.360 --> 07:55.720 We are not doing any kind of sophisticated encryption of this. 148 07:55.720 --> 07:57.200 We're not exchanging keys. 149 07:57.200 --> 08:02.280 We're not doing anything besides just saying, hey, I should have access to you. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 149 07:57.200 --> 08:02.280 We're not doing anything besides just saying, hey, I should have access to you. 150 08:02.280 --> 08:04.400 Here's the password in plain text. 151 08:04.400 --> 08:09.020 And these community strings are tied to either read only operation or read 152 08:09.020 --> 08:10.280 write operation. 153 08:10.280 --> 08:13.160 And so the device has this configured. 154 08:13.160 --> 08:16.320 So hey, I've got an NMS that does read only operations. 155 08:16.320 --> 08:20.000 I'm going to give it the read only community string that tells the device that, 156 08:20.000 --> 08:20.400 hey, I'm 157 08:20.400 --> 08:25.530 supposed to use or it's allowed to access me, but it's not allowed to configure 158 08:25.530 --> 08:26.080 me versus 159 08:26.080 --> 08:28.880 read write can do both. 160 08:28.880 --> 08:33.430 Now the one good news in this from a security perspective is we can add an WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 160 08:28.880 --> 08:33.430 Now the one good news in this from a security perspective is we can add an 161 08:33.430 --> 08:34.560 access control 162 08:34.560 --> 08:42.200 list to say only this IP address should be able to access me via SNMP. 163 08:42.200 --> 08:48.140 So if we do have an environment that requires version 2C, we just we can't 164 08:48.140 --> 08:49.400 reconfigure the 165 08:49.400 --> 08:55.560 whole network and we're adding devices fine, but make sure that we're adding an 166 08:55.560 --> 08:56.120 ACL to 167 08:56.120 --> 09:02.100 every single device so that at least only the IP address for our NMS and other WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 167 08:56.120 --> 09:02.100 every single device so that at least only the IP address for our NMS and other 168 09:02.100 --> 09:02.880 systems 169 09:02.880 --> 09:09.680 that require it will be able to access the device via SNMP. 170 09:09.680 --> 09:13.720 But as we might imagine, it would be best not to use V2C at all and instead use 171 09:13.720 --> 09:14.280 version 172 09:14.280 --> 09:15.280 3. 173 09:15.280 --> 09:16.600 So what does version 3 give us? 174 09:16.600 --> 09:18.400 Well, what doesn't it give us? 175 09:18.400 --> 09:22.280 It gives us integrity, which sounds like, okay, great. 176 09:22.280 --> 09:26.520 It's more honest, but data integrity means that no bits have been flipped. 177 09:26.520 --> 09:28.480 There's no man in the middle attack happening. 178 09:28.480 --> 09:31.360 That's really important for a security perspective. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 178 09:28.480 --> 09:31.360 That's really important for a security perspective. 179 09:31.360 --> 09:35.020 And then other common security functionalities that we've talked about 180 09:35.020 --> 09:36.840 throughout this course, 181 09:36.840 --> 09:42.520 authentication and encryption, all of this is included with version 3. 182 09:42.520 --> 09:46.760 Furthermore, it's going to use the concept of user accounts. 183 09:46.760 --> 09:53.000 So we're basically performing logins that's going to allow us to take advantage 184 09:53.000 --> 09:53.760 of these 185 09:53.760 --> 09:55.840 different security functions. 186 09:55.840 --> 09:58.560 Now these logins can be configured locally. 187 09:58.560 --> 10:03.330 So we can have local user names and passwords on the device that the SNMP or WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 187 09:58.560 --> 10:03.330 So we can have local user names and passwords on the device that the SNMP or 188 10:03.330 --> 10:04.600 really the NMS 189 10:04.600 --> 10:06.000 is going to leverage. 190 10:06.000 --> 10:11.770 However, we can also take advantage of something like EAP and RADIUS in order 191 10:11.770 --> 10:13.560 to fully authenticate 192 10:13.560 --> 10:18.720 our users as well as to scale out when we have users we want to authenticate, 193 10:18.720 --> 10:19.160 but then 194 10:19.160 --> 10:20.680 that user leaves the organization. 195 10:20.680 --> 10:24.100 We want to remove that user whole lot nicer to have that in a RADIUS server 196 10:24.100 --> 10:24.800 than to have 197 10:24.800 --> 10:28.440 it locally configured on every single device in the network. 198 10:28.440 --> 10:34.360 So the local is really typically more intended to be used as a backup system in WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 198 10:28.440 --> 10:34.360 So the local is really typically more intended to be used as a backup system in 199 10:34.360 --> 10:35.120 case the 200 10:35.120 --> 10:38.240 network is down and we don't have access to the RADIUS server. 201 10:38.240 --> 10:44.160 But again, SNMP, not super simple, but the framework is there and we see it. 202 10:44.160 --> 10:51.220 We've pretty much every corporate enterprise network is going to have some kind 203 10:51.220 --> 10:52.400 of NMS deployed 204 10:52.400 --> 10:53.880 to take advantage of SNMP. 205 10:53.880 --> 10:56.640 It's not a bad thing to use SNMP on the network. 206 10:56.640 --> 11:00.800 We just are seeing that SNMP is getting replaced by more sophisticated systems WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 206 10:56.640 --> 11:00.800 We just are seeing that SNMP is getting replaced by more sophisticated systems 207 11:00.800 --> 11:02.160 these days. 208 11:02.160 --> 11:06.610 And if we are deploying SNMP at a very minimum level, make sure we're deploying 209 11:06.610 --> 11:07.560 access control 210 11:07.560 --> 11:09.920 lists with V2C if that's what's in place. 211 11:09.920 --> 11:14.540 However, the strong preference is going to be that we're deploying SNMP version 212 11:14.540 --> 11:15.120 3 any 213 11:15.120 --> 11:15.720 chance we get.