WEBVTT

1
00:00.000 --> 00:01.870 align:middle line:84%


2
00:01.870 --> 00:03.610 align:middle line:90%
As network
administrators, we really

3
00:03.610 --> 00:04.970 align:middle line:84%
do want to know what's going on.

4
00:04.970 --> 00:07.090 align:middle line:90%
We want to know when interfaces
go down if they shouldn't.

5
00:07.090 --> 00:09.280 align:middle line:90%
We want to know about
events that are happening.

6
00:09.280 --> 00:10.510 align:middle line:84%
Is the temperature too high?

7
00:10.510 --> 00:12.940 align:middle line:90%
Or is there too much traffic
going through the network

8
00:12.940 --> 00:14.110 align:middle line:84%
at this part of the network?

9
00:14.110 --> 00:17.450 align:middle line:90%
SNMP is a great tool to help
feed us all that information.

10
00:17.450 --> 00:21.070 align:middle line:90%
So let's take a look at, not
a big history lesson of SNMP,

11
00:21.070 --> 00:24.160 align:middle line:90%
but the two current flavors
that are primarily being

12
00:24.160 --> 00:26.193 align:middle line:84%
used and also how they work.

13
00:26.193 --> 00:27.610 align:middle line:90%
So let's start by
adding ourselves

14
00:27.610 --> 00:29.110 align:middle line:90%
to the mix, you and
I. Let's imagine

15
00:29.110 --> 00:31.390 align:middle line:90%
that we are plugged
into this network
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:29.110 --> 00:31.390 align:middle line:90%
that we are plugged
into this network

16
00:31.390 --> 00:33.170 align:middle line:84%
and here's our PC right here.

17
00:33.170 --> 00:36.790 align:middle line:90%
So for SNMP to work, there
are two players primarily.

18
00:36.790 --> 00:39.790 align:middle line:90%
One is going to be the
client or the agent that's

19
00:39.790 --> 00:41.188 align:middle line:90%
being monitored,
and the other is

20
00:41.188 --> 00:43.480 align:middle line:90%
going to be the manager where
that information is going

21
00:43.480 --> 00:45.130 align:middle line:84%
to be received and processed.

22
00:45.130 --> 00:47.410 align:middle line:90%
So we could have our
network management

23
00:47.410 --> 00:52.420 align:middle line:90%
server, the NMS, or the
manager, running on a server,

24
00:52.420 --> 00:55.390 align:middle line:90%
or it could be software running
on a PC or some other device.

25
00:55.390 --> 00:57.190 align:middle line:90%
Hopefully that device
is up most of time.

26
00:57.190 --> 00:59.920 align:middle line:90%
And for this discussion,
let's say the manager software

27
00:59.920 --> 01:00.990 align:middle line:84%
sitting right here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
00:59.920 --> 01:00.990 align:middle line:84%
sitting right here.

28
01:00.990 --> 01:03.730 align:middle line:84%
And then we can have the agent.

29
01:03.730 --> 01:06.790 align:middle line:90%
Or that agent maybe extra
software we put on that system

30
01:06.790 --> 01:10.013 align:middle line:90%
or maybe built into the
operating system of the device.

31
01:10.013 --> 01:11.680 align:middle line:90%
We have an agent
running on our devices.

32
01:11.680 --> 01:16.120 align:middle line:90%
We have an agent on the
routers and on the switches

33
01:16.120 --> 01:19.758 align:middle line:90%
and on our printers and any
other SNMP manageable devices.

34
01:19.758 --> 01:21.550 align:middle line:90%
And what we do is we
simply associate them.

35
01:21.550 --> 01:23.980 align:middle line:90%
We tell the manager, hey,
you have an agent right here

36
01:23.980 --> 01:25.910 align:middle line:84%
at this IP address on this box.

37
01:25.910 --> 01:27.730 align:middle line:90%
And we configure the
agent on that device

38
01:27.730 --> 01:30.470 align:middle line:90%
to allow the request coming
in from that manager.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:27.730 --> 01:30.470 align:middle line:90%
to allow the request coming
in from that manager.

39
01:30.470 --> 01:32.710 align:middle line:90%
And so most of the time,
the network manager

40
01:32.710 --> 01:35.140 align:middle line:84%
is going to be making requests.

41
01:35.140 --> 01:37.030 align:middle line:90%
And sometimes those are
referred to as gets,

42
01:37.030 --> 01:39.890 align:middle line:90%
where they're saying I'd
like to see this information.

43
01:39.890 --> 01:42.670 align:middle line:90%
Maybe I want to see
the power supply

44
01:42.670 --> 01:45.280 align:middle line:90%
voltage for a certain power
supply or the temperature

45
01:45.280 --> 01:47.140 align:middle line:90%
or how much traffic
is going through.

46
01:47.140 --> 01:49.390 align:middle line:90%
And the way we're going to
be able to accurately ask

47
01:49.390 --> 01:52.465 align:middle line:90%
for those details is based
on having the right MIB.

48
01:52.465 --> 01:55.690 align:middle line:90%
MIB stands for the
management information base.

49
01:55.690 --> 01:58.630 align:middle line:84%
And it's a detailed record.

50
01:58.630 --> 02:00.730 align:middle line:90%
It's sort of like
a serial number.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

50
01:58.630 --> 02:00.730 align:middle line:90%
It's sort of like
a serial number.

51
02:00.730 --> 02:03.730 align:middle line:90%
Think about a serial number
for each individual component

52
02:03.730 --> 02:04.780 align:middle line:84%
on a device.

53
02:04.780 --> 02:06.610 align:middle line:90%
Now the problem
is that there may

54
02:06.610 --> 02:10.509 align:middle line:90%
be hundreds of
individual details

55
02:10.509 --> 02:13.120 align:middle line:90%
that we can pull that are in
the MIB for a certain switch,

56
02:13.120 --> 02:16.300 align:middle line:90%
but they may be different than
the ones that are in a router,

57
02:16.300 --> 02:20.050 align:middle line:90%
or they may be different than
the ones are in a Linux server,

58
02:20.050 --> 02:21.118 align:middle line:84%
for example.

59
02:21.118 --> 02:23.410 align:middle line:90%
So one of the key elements
is that we want to make sure

60
02:23.410 --> 02:26.938 align:middle line:90%
that our SNMP manager is
using the appropriate MIB,

61
02:26.938 --> 02:29.230 align:middle line:90%
the management information
base, the information on how

62
02:29.230 --> 02:31.980 align:middle line:90%
to get to everything and what's
available based on the device
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

62
02:29.230 --> 02:31.980 align:middle line:90%
to get to everything and what's
available based on the device

63
02:31.980 --> 02:33.010 align:middle line:84%
is managing.

64
02:33.010 --> 02:34.870 align:middle line:90%
So this manager may
have separate MIBs,

65
02:34.870 --> 02:37.660 align:middle line:90%
and it will, have separate
MIBs, one for a switch,

66
02:37.660 --> 02:41.440 align:middle line:90%
one for a router, and one for a
server, so it knows how to ask.

67
02:41.440 --> 02:43.558 align:middle line:90%
Now if you know exactly
what that MIB is,

68
02:43.558 --> 02:45.100 align:middle line:90%
it will be important
in setting it up

69
02:45.100 --> 02:46.540 align:middle line:84%
to specify the correct MIB.

70
02:46.540 --> 02:50.230 align:middle line:90%
But there's a lot of really
cool software out there today

71
02:50.230 --> 02:54.700 align:middle line:90%
that can query a device,
make some educated guesses,

72
02:54.700 --> 02:56.920 align:middle line:90%
and then throw the
appropriate MIBs at it.

73
02:56.920 --> 02:59.667 align:middle line:90%
So that's a little more
loose, not quite as tight.

74
02:59.667 --> 03:01.750 align:middle line:90%
But that's also an option
for many of the managers
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

74
02:59.667 --> 03:01.750 align:middle line:90%
But that's also an option
for many of the managers

75
03:01.750 --> 03:02.792 align:middle line:84%
that are out there today.

76
03:02.792 --> 03:03.310 align:middle line:84%
OK.

77
03:03.310 --> 03:05.710 align:middle line:90%
So the concept is we
have a manager that

78
03:05.710 --> 03:08.050 align:middle line:90%
is aware of the
capabilities and what

79
03:08.050 --> 03:11.200 align:middle line:90%
can be looked at on these
devices, these SNMP agents.

80
03:11.200 --> 03:13.715 align:middle line:90%
The manager makes
requests, or gets,

81
03:13.715 --> 03:15.340 align:middle line:90%
and that information
is responded back.

82
03:15.340 --> 03:18.580 align:middle line:90%
There's also the
opportunity or an agent

83
03:18.580 --> 03:21.970 align:middle line:90%
maybe running on router two, to
go ahead and send a message out

84
03:21.970 --> 03:23.710 align:middle line:84%
of the blue to the manager.

85
03:23.710 --> 03:24.827 align:middle line:84%
Why would we do that?

86
03:24.827 --> 03:25.660 align:middle line:84%
Interface goes down.

87
03:25.660 --> 03:27.615 align:middle line:84%
I've been trained to report in.

88
03:27.615 --> 03:28.990 align:middle line:90%
And not just wait
for the manager

89
03:28.990 --> 03:31.090 align:middle line:90%
to pull me but actually
to send it over.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

89
03:28.990 --> 03:31.090 align:middle line:90%
to pull me but actually
to send it over.

90
03:31.090 --> 03:33.460 align:middle line:90%
So there's a couple of terms
that are referred to that.

91
03:33.460 --> 03:34.870 align:middle line:84%
One is called a trap.

92
03:34.870 --> 03:36.460 align:middle line:84%
And there's also an inform.

93
03:36.460 --> 03:40.150 align:middle line:90%
Some of that depends
on the flavor of SNMP

94
03:40.150 --> 03:41.083 align:middle line:84%
that we're using.

95
03:41.083 --> 03:42.750 align:middle line:90%
But again, the trap
or an inform is when

96
03:42.750 --> 03:44.080 align:middle line:84%
we're sending the data over.

97
03:44.080 --> 03:46.540 align:middle line:90%
And the ports, this is also
important for troubleshooting,

98
03:46.540 --> 03:49.060 align:middle line:84%
the ports are UDP.

99
03:49.060 --> 03:52.780 align:middle line:90%
And traditionally, we're using
161, UDP port 161, for the

100
03:52.780 --> 03:53.950 align:middle line:84%
get requests and so forth.

101
03:53.950 --> 03:57.460 align:middle line:90%
And for the traps, those
are going to be using 162.

102
03:57.460 --> 03:59.650 align:middle line:90%
Now the key is, if they're
using different ports,

103
03:59.650 --> 04:01.690 align:middle line:90%
it's OK if they
both know about it,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
03:59.650 --> 04:01.690 align:middle line:90%
it's OK if they
both know about it,

104
04:01.690 --> 04:04.000 align:middle line:90%
if the server and the
client both know about it

105
04:04.000 --> 04:07.030 align:middle line:90%
and if it is configured to look
for and use those other ports,

106
04:07.030 --> 04:07.888 align:middle line:84%
those could be used.

107
04:07.888 --> 04:09.680 align:middle line:90%
But these are good
defaults to be aware of.

108
04:09.680 --> 04:11.138 align:middle line:90%
So if you have
access control lists

109
04:11.138 --> 04:12.670 align:middle line:90%
or anything else
in the network, you

110
04:12.670 --> 04:13.878 align:middle line:84%
want to look at that as well.

111
04:13.878 --> 04:17.950 align:middle line:90%
Also, if we set up an agent, we
configure SNMP on this device,

112
04:17.950 --> 04:22.467 align:middle line:90%
probably, just probably, we
don't want Bob, the user,

113
04:22.467 --> 04:24.300 align:middle line:90%
let me go ahead and let
me put a different--

114
04:24.300 --> 04:27.140 align:middle line:90%
we don't want Bob the user to
go to start doing queries like,

115
04:27.140 --> 04:29.870 align:middle line:90%
hey, give me this information,
give me that information.

116
04:29.870 --> 04:32.440 align:middle line:90%
So we can also set up
access control lists
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

116
04:29.870 --> 04:32.440 align:middle line:90%
So we can also set up
access control lists

117
04:32.440 --> 04:35.980 align:middle line:90%
as far as the source IP address
of who can even make a request,

118
04:35.980 --> 04:38.970 align:middle line:90%
and then furthermore, we have
a little bit of security.

119
04:38.970 --> 04:41.560 align:middle line:90%
And that leads to another
discussion of which flavor

120
04:41.560 --> 04:42.250 align:middle line:84%
of SNMP.

121
04:42.250 --> 04:44.910 align:middle line:90%
If we're using version
2C, we're going

122
04:44.910 --> 04:47.168 align:middle line:84%
to be using community strings.

123
04:47.168 --> 04:49.210 align:middle line:90%
And the way community
strings work are like this.

124
04:49.210 --> 04:52.000 align:middle line:90%
If this is our manager and
this is the agent, when we're

125
04:52.000 --> 04:53.770 align:middle line:90%
making requests,
we are going to be

126
04:53.770 --> 04:57.470 align:middle line:90%
using community strings based
on read only or read/write.

127
04:57.470 --> 04:59.580 align:middle line:90%
So let's imagine we
have a community string.

128
04:59.580 --> 05:01.780 align:middle line:90%
Think of a community
string like a password.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

128
04:59.580 --> 05:01.780 align:middle line:90%
Think of a community
string like a password.

129
05:01.780 --> 05:05.380 align:middle line:90%
And let's say the
password is password one.

130
05:05.380 --> 05:07.120 align:middle line:90%
And for the read/write
community string,

131
05:07.120 --> 05:10.920 align:middle line:84%
the password is password two.

132
05:10.920 --> 05:13.620 align:middle line:90%
So if the server
is making a request

133
05:13.620 --> 05:16.020 align:middle line:90%
and it's just a get
request, I'm looking for,

134
05:16.020 --> 05:18.360 align:middle line:90%
pulling information,
it's going to include

135
05:18.360 --> 05:21.420 align:middle line:90%
the password or the read
only community string,

136
05:21.420 --> 05:23.693 align:middle line:90%
and our tools say,
yes, no problem, I

137
05:23.693 --> 05:25.110 align:middle line:90%
will give that
information to you.

138
05:25.110 --> 05:28.080 align:middle line:90%
You have the right password,
the right community string.

139
05:28.080 --> 05:31.260 align:middle line:90%
Or if the SNMP manager wants to
change a setting and do a set,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

139
05:28.080 --> 05:31.260 align:middle line:90%
Or if the SNMP manager wants to
change a setting and do a set,

140
05:31.260 --> 05:33.000 align:middle line:90%
well it's like a put,
pushing information

141
05:33.000 --> 05:35.448 align:middle line:90%
to the device for
modifying a detail,

142
05:35.448 --> 05:36.990 align:middle line:90%
along with that
request it would need

143
05:36.990 --> 05:38.900 align:middle line:90%
to use a community
string that's associated

144
05:38.900 --> 05:40.420 align:middle line:84%
with read/write permission.

145
05:40.420 --> 05:43.860 align:middle line:90%
And that way the router, the
agent running on this router,

146
05:43.860 --> 05:46.920 align:middle line:90%
would say, OK, first of all,
is the incoming source address,

147
05:46.920 --> 05:49.710 align:middle line:90%
does it pass the access control
list associated with the SNMP

148
05:49.710 --> 05:53.280 align:middle line:90%
and do they have the appropriate
community string that

149
05:53.280 --> 05:56.160 align:middle line:90%
would allow a read/write
access or permissions to change

150
05:56.160 --> 05:57.150 align:middle line:84%
my config?

151
05:57.150 --> 05:59.170 align:middle line:90%
So that's the
security in version 2.

152
05:59.170 --> 06:02.400 align:middle line:90%
Now version 3,
it's a lot smarter.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

152
05:59.170 --> 06:02.400 align:middle line:90%
Now version 3,
it's a lot smarter.

153
06:02.400 --> 06:04.470 align:middle line:90%
And we'll have a separate
video in this series

154
06:04.470 --> 06:07.920 align:middle line:90%
right here, in this set of
videos, on version 3 for SNMP.

155
06:07.920 --> 06:09.060 align:middle line:84%
But the overview is this.

156
06:09.060 --> 06:11.998 align:middle line:84%
With SNMP, we can set up views.

157
06:11.998 --> 06:13.290 align:middle line:84%
And a view says, you know what?

158
06:13.290 --> 06:15.630 align:middle line:90%
Instead of just like the
whole router, everything

159
06:15.630 --> 06:17.400 align:middle line:90%
that could possibly
be looked at,

160
06:17.400 --> 06:20.990 align:middle line:90%
why don't we just
specify a subsection?

161
06:20.990 --> 06:24.222 align:middle line:90%
Or like the interface status
or something like that, instead

162
06:24.222 --> 06:24.930 align:middle line:84%
the whole system?

163
06:24.930 --> 06:26.100 align:middle line:84%
So we can set up views.

164
06:26.100 --> 06:27.517 align:middle line:90%
We can set up a
view that says you

165
06:27.517 --> 06:29.400 align:middle line:90%
can look at the whole
thing or parts of it.

166
06:29.400 --> 06:32.500 align:middle line:90%
And then we'd also
set up groups.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

166
06:29.400 --> 06:32.500 align:middle line:90%
And then we'd also
set up groups.

167
06:32.500 --> 06:34.240 align:middle line:90%
And a group is going
to indicate what

168
06:34.240 --> 06:35.770 align:middle line:84%
we can do regarding that view.

169
06:35.770 --> 06:40.770 align:middle line:90%
Now let's say, let's call
it group A. If we set up

170
06:40.770 --> 06:44.550 align:middle line:90%
group A on the device,
we say, OK, for group A,

171
06:44.550 --> 06:49.520 align:middle line:90%
group A can do read only for
a view called U Number One.

172
06:49.520 --> 06:52.350 align:middle line:90%
And that way, anybody who's
a member of group A can only

173
06:52.350 --> 06:54.810 align:middle line:90%
do views, read
information, based

174
06:54.810 --> 06:57.180 align:middle line:90%
on what was identified by
that view, view number one.

175
06:57.180 --> 07:02.450 align:middle line:90%
Or if we had group B, and
group B was given permissions
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

175
06:57.180 --> 07:02.450 align:middle line:90%
Or if we had group B, and
group B was given permissions

176
07:02.450 --> 07:06.440 align:middle line:90%
to go ahead and do read/write
access in view one,

177
07:06.440 --> 07:09.290 align:middle line:90%
then when a user connects
and authenticates

178
07:09.290 --> 07:10.940 align:middle line:90%
and they're a member
of group B, they

179
07:10.940 --> 07:12.770 align:middle line:90%
would have the
read/write permissions.

180
07:12.770 --> 07:13.940 align:middle line:84%
And we'll break that down.

181
07:13.940 --> 07:16.700 align:middle line:90%
I'll give you some examples
of not only configuring it,

182
07:16.700 --> 07:19.130 align:middle line:90%
but also verifying it
as part of these videos.

183
07:19.130 --> 07:21.780 align:middle line:90%
And then the last thing
is to create users.

184
07:21.780 --> 07:25.630 align:middle line:90%
So we create users, we'd specify
what groups they belong to,

185
07:25.630 --> 07:28.960 align:middle line:90%
which would then tell the
SNMP on the system what

186
07:28.960 --> 07:29.930 align:middle line:84%
they're able to do.

187
07:29.930 --> 07:32.680 align:middle line:90%
But here's the reason that
I think most people are not
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

187
07:29.930 --> 07:32.680 align:middle line:90%
But here's the reason that
I think most people are not

188
07:32.680 --> 07:34.630 align:middle line:84%
using SNMP version 3.

189
07:34.630 --> 07:36.080 align:middle line:84%
There is more configuration.

190
07:36.080 --> 07:37.960 align:middle line:90%
You have views, you
have groups, you

191
07:37.960 --> 07:41.080 align:middle line:90%
have users in those groups
and permissions assigned.

192
07:41.080 --> 07:44.400 align:middle line:90%
And so with version 2C
with community strings,

193
07:44.400 --> 07:46.150 align:middle line:90%
you just have read
only community strings,

194
07:46.150 --> 07:49.030 align:middle line:90%
like passwords, and
read/write community strings

195
07:49.030 --> 07:51.880 align:middle line:90%
with passwords, and it's
easier to configure.

196
07:51.880 --> 07:54.280 align:middle line:90%
So I want you, in a
sense of troubleshooting,

197
07:54.280 --> 07:57.490 align:middle line:90%
to be aware of what
those options are

198
07:57.490 --> 07:59.802 align:middle line:90%
and also to see it
in a demonstration.

199
07:59.802 --> 08:02.260 align:middle line:90%
And that way, you'll be more
comfortable in troubleshooting
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

199
07:59.802 --> 08:02.260 align:middle line:90%
And that way, you'll be more
comfortable in troubleshooting

200
08:02.260 --> 08:04.350 align:middle line:84%
it if SNMP isn't working.

201
08:04.350 --> 08:04.850 align:middle line:84%
All right.

202
08:04.850 --> 08:06.720 align:middle line:84%
So that's our overview of SNMP.

203
08:06.720 --> 08:08.380 align:middle line:90%
In the next video,
I'd like to take you

204
08:08.380 --> 08:11.650 align:middle line:90%
to a live network where I've
got SNMP version 2 running

205
08:11.650 --> 08:13.900 align:middle line:90%
and configured, walk
you through those steps.

206
08:13.900 --> 08:15.490 align:middle line:90%
You can see the
individual pieces

207
08:15.490 --> 08:17.920 align:middle line:90%
and get a comfort level
with SNMP version 2

208
08:17.920 --> 08:20.770 align:middle line:90%
and it's fairly simple
community strings.

209
08:20.770 --> 08:23.080 align:middle line:90%
So I'll see you in that
next video in just a moment.

210
08:23.080 --> 08:25.330 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

211
08:25.330 --> 08:28.530 align:middle line:90%
and I'd like to thank
you for viewing.