WEBVTT

1
00:00.000 --> 00:01.210 align:middle line:84%


2
00:01.210 --> 00:03.430 align:middle line:90%
In the previous video, we
looked at the configuration

3
00:03.430 --> 00:05.860 align:middle line:90%
on the router for
SNMP version 3,

4
00:05.860 --> 00:09.280 align:middle line:90%
which included views, groups,
which have permissions

5
00:09.280 --> 00:11.830 align:middle line:90%
associate with those views,
and then users, which

6
00:11.830 --> 00:13.780 align:middle line:84%
are associated with the groups.

7
00:13.780 --> 00:16.280 align:middle line:90%
So in this video, I'd like to
look at the back half of that,

8
00:16.280 --> 00:19.750 align:middle line:90%
which is how do we train
our SNMP manager to manage

9
00:19.750 --> 00:21.923 align:middle line:84%
a device using SNMP version 3?

10
00:21.923 --> 00:24.340 align:middle line:90%
So without further ado, let's
go to our management station

11
00:24.340 --> 00:26.020 align:middle line:90%
and in this
demonstration, I'm using

12
00:26.020 --> 00:30.950 align:middle line:90%
Observium as a free SNMP manager
that's perfect for the task.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:26.020 --> 00:30.950 align:middle line:90%
Observium as a free SNMP manager
that's perfect for the task.

13
00:30.950 --> 00:32.830 align:middle line:90%
So here on the SNMP
manager, I simply

14
00:32.830 --> 00:34.780 align:middle line:84%
said, OK, we're using version 3.

15
00:34.780 --> 00:37.840 align:middle line:90%
I specify we're using the
default port of UDP port

16
00:37.840 --> 00:39.880 align:middle line:84%
161 for the SNMP.

17
00:39.880 --> 00:42.100 align:middle line:90%
And then over here for SNMP
version 3 authentication,

18
00:42.100 --> 00:45.040 align:middle line:90%
because I said SNMP version
3 here, said OK, great,

19
00:45.040 --> 00:47.200 align:middle line:90%
what type of security
are you using?

20
00:47.200 --> 00:48.760 align:middle line:84%
So there's three options here.

21
00:48.760 --> 00:52.610 align:middle line:90%
authPriv says we're doing
authentication, right?

22
00:52.610 --> 00:53.980 align:middle line:84%
That's that hashing piece.

23
00:53.980 --> 00:57.190 align:middle line:90%
And we're also doing encryption,
which is the privacy piece.

24
00:57.190 --> 01:00.683 align:middle line:90%
So authPriv like this
means we're doing both.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
00:57.190 --> 01:00.683 align:middle line:90%
So authPriv like this
means we're doing both.

25
01:00.683 --> 01:02.350 align:middle line:90%
So what if you want
to do authentication

26
01:02.350 --> 01:04.870 align:middle line:90%
but you don't want to do any
encryption for whatever reason.

27
01:04.870 --> 01:06.740 align:middle line:90%
Maybe your device
doesn't support it.

28
01:06.740 --> 01:08.230 align:middle line:84%
This is the option you'd pick.

29
01:08.230 --> 01:10.720 align:middle line:90%
So authNoPriv simply
says I want to do

30
01:10.720 --> 01:12.853 align:middle line:90%
the authentication, the
hashing, but I'm not

31
01:12.853 --> 01:14.020 align:middle line:84%
going to use the encryption.

32
01:14.020 --> 01:16.840 align:middle line:90%
So at the router, I specified
that we're using authentication

33
01:16.840 --> 01:18.970 align:middle line:90%
and we're using encryption,
the privacy option.

34
01:18.970 --> 01:21.190 align:middle line:90%
But if I'd said we're
just using authentication

35
01:21.190 --> 01:24.850 align:middle line:90%
and no privacy, no encryption,
I would select authNoPriv here.

36
01:24.850 --> 01:27.850 align:middle line:90%
Or if you don't want any
of the authentication

37
01:27.850 --> 01:29.560 align:middle line:90%
and you don't want
any of the encryption,

38
01:29.560 --> 01:32.720 align:middle line:90%
you might as well
use SNMP version 2.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:29.560 --> 01:32.720 align:middle line:90%
you might as well
use SNMP version 2.

39
01:32.720 --> 01:34.540 align:middle line:90%
However, there is
options for that, too.

40
01:34.540 --> 01:37.030 align:middle line:90%
So no auth, no Priv,
means you're not

41
01:37.030 --> 01:39.820 align:middle line:90%
doing the authentication,
you're not doing the encryption.

42
01:39.820 --> 01:42.580 align:middle line:90%
But we're still using SNMP
version 3, but just not taking

43
01:42.580 --> 01:44.540 align:middle line:84%
advantage of the benefits.

44
01:44.540 --> 01:46.343 align:middle line:90%
So if we are using
auth and priv,

45
01:46.343 --> 01:48.010 align:middle line:90%
you need to put in
the details for that.

46
01:48.010 --> 01:49.725 align:middle line:90%
So for the
authorization username,

47
01:49.725 --> 01:51.350 align:middle line:90%
I'll put the username
and the password.

48
01:51.350 --> 01:54.182 align:middle line:90%
Also the hashing algorithm that
we're using for authentication.

49
01:54.182 --> 01:56.140 align:middle line:90%
And then furthermore,
because we're using priv,

50
01:56.140 --> 01:58.930 align:middle line:90%
meaning encryption, I
specify the password

51
01:58.930 --> 02:00.910 align:middle line:90%
that I specified for
encryption and I also
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
01:58.930 --> 02:00.910 align:middle line:90%
that I specified for
encryption and I also

52
02:00.910 --> 02:02.180 align:middle line:84%
specified the flavor.

53
02:02.180 --> 02:04.900 align:middle line:90%
Now when I initially
set this up,

54
02:04.900 --> 02:07.940 align:middle line:90%
I don't recall if
I used 128 or 256.

55
02:07.940 --> 02:11.275 align:middle line:90%
I know the user I
just set up used 256.

56
02:11.275 --> 02:12.400 align:middle line:84%
So here, I'm looking at it.

57
02:12.400 --> 02:14.567 align:middle line:90%
If I was troubleshooting
this and it wasn't working,

58
02:14.567 --> 02:17.050 align:middle line:90%
I might want to go back
to the router and set 128.

59
02:17.050 --> 02:20.920 align:middle line:90%
Or as a test, you might want
to do no auth no priv just

60
02:20.920 --> 02:24.415 align:middle line:90%
to verify basic communications
and then come back here and add

61
02:24.415 --> 02:25.040 align:middle line:84%
those features.

62
02:25.040 --> 02:26.470 align:middle line:90%
So whatever you
do to troubleshoot

63
02:26.470 --> 02:28.553 align:middle line:90%
to set up a new device,
you have the options here.

64
02:28.553 --> 02:32.920 align:middle line:90%
You could also test with version
2 with just a community string.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

64
02:28.553 --> 02:32.920 align:middle line:90%
You could also test with version
2 with just a community string.

65
02:32.920 --> 02:34.420 align:middle line:84%
Set the router up to support it.

66
02:34.420 --> 02:36.490 align:middle line:90%
If that works,
then we could know

67
02:36.490 --> 02:38.530 align:middle line:90%
that the actual port's
available and it's not

68
02:38.530 --> 02:39.740 align:middle line:84%
being blocked in transit.

69
02:39.740 --> 02:42.850 align:middle line:90%
So getting a working baseline,
finding a piece that does work

70
02:42.850 --> 02:45.590 align:middle line:90%
and then adding on from there
is not a bad idea as well.

71
02:45.590 --> 02:46.090 align:middle line:84%
All right.

72
02:46.090 --> 02:48.143 align:middle line:90%
So that that is already
configured and done.

73
02:48.143 --> 02:50.560 align:middle line:90%
And as a result, this has been
up for like maybe two hours

74
02:50.560 --> 02:51.160 align:middle line:84%
now.

75
02:51.160 --> 02:53.500 align:middle line:90%
So if you get an
overview of this device,

76
02:53.500 --> 02:59.260 align:middle line:90%
it has pulled all the
details via SNMP version 3.

77
02:59.260 --> 03:00.700 align:middle line:90%
That's what it's
currently using.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
02:59.260 --> 03:00.700 align:middle line:90%
That's what it's
currently using.

78
03:00.700 --> 03:03.510 align:middle line:90%
There's graphs, that's the
availability, the uptime,

79
03:03.510 --> 03:08.950 align:middle line:90%
processor information,
memory information, storage,

80
03:08.950 --> 03:10.540 align:middle line:84%
network statistics.

81
03:10.540 --> 03:12.400 align:middle line:90%
And again, all of
these are based

82
03:12.400 --> 03:15.440 align:middle line:90%
on this SNMP manager
going out periodically,

83
03:15.440 --> 03:17.800 align:middle line:90%
I think it's every 10 minutes
by default, and pulling.

84
03:17.800 --> 03:20.200 align:middle line:90%
Another important aspect
is that if we want an SNMP

85
03:20.200 --> 03:24.340 align:middle line:90%
agent to send messages to the
server it on its own like,

86
03:24.340 --> 03:27.010 align:middle line:90%
oh, this was just exceeded
or this interface went down,

87
03:27.010 --> 03:30.820 align:middle line:90%
we need to train the SNMP
agent or the client to do that.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

87
03:27.010 --> 03:30.820 align:middle line:90%
we need to train the SNMP
agent or the client to do that.

88
03:30.820 --> 03:33.130 align:middle line:90%
And that's what the command
SNMP dash server space

89
03:33.130 --> 03:36.280 align:middle line:90%
host, and then the credentials,
if it's version 2 the community

90
03:36.280 --> 03:39.490 align:middle line:90%
string, if it's version 3, the
client information, to send

91
03:39.490 --> 03:40.790 align:middle line:84%
those traps.

92
03:40.790 --> 03:43.120 align:middle line:90%
So if we're expecting
messages out of the blue

93
03:43.120 --> 03:45.653 align:middle line:90%
to come from an SNMP
agent or a client,

94
03:45.653 --> 03:47.320 align:middle line:90%
we're not going to
see them unless we've

95
03:47.320 --> 03:50.950 align:middle line:90%
trained the SNMP agent or client
to know where that SNMP server

96
03:50.950 --> 03:52.630 align:middle line:84%
is that it should send them to.

97
03:52.630 --> 03:55.390 align:middle line:90%
So back on this device, if we
went to the properties of this

98
03:55.390 --> 03:59.200 align:middle line:90%
once again and we clicked
on MIBs, once again,

99
03:59.200 --> 04:03.130 align:middle line:90%
I got to tell you, this network
management station, Observium,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

99
03:59.200 --> 04:03.130 align:middle line:90%
I got to tell you, this network
management station, Observium,

100
04:03.130 --> 04:06.970 align:middle line:90%
it just made some estimated
guesses on what that device was

101
04:06.970 --> 04:08.853 align:middle line:90%
based on some initial
polling and then it

102
04:08.853 --> 04:10.270 align:middle line:90%
through all these
MIBs at it based

103
04:10.270 --> 04:11.080 align:middle line:84%
on what it thought it was.

104
04:11.080 --> 04:13.622 align:middle line:90%
And as an administrator, we can
go in and say, you know what?

105
04:13.622 --> 04:15.207 align:middle line:90%
This MIB is not
appropriate for that.

106
04:15.207 --> 04:17.540 align:middle line:90%
I want to take that off, take
that off, and remove them.

107
04:17.540 --> 04:19.180 align:middle line:90%
And the key is, we want our
network management station

108
04:19.180 --> 04:21.820 align:middle line:90%
to have the correct MIBs
or the correct enough MIBs

109
04:21.820 --> 04:24.250 align:middle line:90%
to adequately address
and get information

110
04:24.250 --> 04:26.380 align:middle line:90%
about all the pieces
on that device that

111
04:26.380 --> 04:29.590 align:middle line:90%
are available as object
IDs as part of the MIB

112
04:29.590 --> 04:31.360 align:middle line:84%
or that managed device.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

112
04:29.590 --> 04:31.360 align:middle line:84%
or that managed device.

113
04:31.360 --> 04:32.500 align:middle line:84%
So it's amazing stuff.

114
04:32.500 --> 04:34.333 align:middle line:90%
And although it does
take a little more work

115
04:34.333 --> 04:36.040 align:middle line:90%
to set up SNMP
version 3, it is worth

116
04:36.040 --> 04:38.410 align:middle line:90%
it to have the security
involved with the authentication

117
04:38.410 --> 04:41.190 align:middle line:90%
and the encryption that SNMP
version 3 brings to the table.

118
04:41.190 --> 04:41.690 align:middle line:84%
All right.

119
04:41.690 --> 04:43.360 align:middle line:90%
In the next video,
I'd like to talk

120
04:43.360 --> 04:44.710 align:middle line:84%
with you about troubleshooting.

121
04:44.710 --> 04:46.810 align:middle line:90%
Whether it's version
2 or version 3,

122
04:46.810 --> 04:49.660 align:middle line:90%
if SNMP is not working,
I'd like to share with you

123
04:49.660 --> 04:52.240 align:middle line:90%
the top things to look
at that are probably

124
04:52.240 --> 04:53.170 align:middle line:84%
causing the problem.

125
04:53.170 --> 04:54.710 align:middle line:90%
And we'll do that
in the next video.

126
04:54.710 --> 04:55.720 align:middle line:90%
So I'll see you there
in just a moment.

127
04:55.720 --> 04:58.330 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

128
04:58.330 --> 05:01.540 align:middle line:90%
And I'd like to thank
you for viewing.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

128
04:58.330 --> 05:01.540 align:middle line:90%
And I'd like to thank
you for viewing.