WEBVTT

1
00:00.000 --> 00:00.920 align:middle line:84%


2
00:00.920 --> 00:03.152 align:middle line:90%
Some features like SNMP,
when they are working

3
00:03.152 --> 00:04.860 align:middle line:90%
and you've got a good
management station,

4
00:04.860 --> 00:06.650 align:middle line:90%
it can give you a
great insight to what's

5
00:06.650 --> 00:08.117 align:middle line:84%
going on on the network.

6
00:08.117 --> 00:09.950 align:middle line:90%
But when it breaks or
when it's not working,

7
00:09.950 --> 00:10.940 align:middle line:84%
it can be frustrating.

8
00:10.940 --> 00:12.777 align:middle line:90%
So in this video,
I'd like to recall

9
00:12.777 --> 00:15.110 align:middle line:90%
what we've taken a look at
in the previous three or four

10
00:15.110 --> 00:18.530 align:middle line:90%
videos and then focus on a
few of the troubleshooting

11
00:18.530 --> 00:21.890 align:middle line:90%
aspects regarding SNMP and
what to look for in the event

12
00:21.890 --> 00:24.950 align:middle line:90%
that SNMP stops
responding or we can't get

13
00:24.950 --> 00:27.210 align:middle line:84%
it working in the first place.

14
00:27.210 --> 00:29.380 align:middle line:90%
So let's create a list of
things that can go wrong.

15
00:29.380 --> 00:31.880 align:middle line:90%
We'll imagine this
is our SNMP server.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:29.380 --> 00:31.880 align:middle line:90%
We'll imagine this
is our SNMP server.

16
00:31.880 --> 00:34.820 align:middle line:90%
And we can just pick
any device as an agent.

17
00:34.820 --> 00:35.370 align:middle line:84%
All right.

18
00:35.370 --> 00:36.850 align:middle line:84%
So what could go wrong?

19
00:36.850 --> 00:39.140 align:middle line:90%
Let's start with
IP connectivity.

20
00:39.140 --> 00:42.800 align:middle line:90%
And including the correct
ports, so UDP port 161,

21
00:42.800 --> 00:45.140 align:middle line:90%
and if we have traps
that might be 162.

22
00:45.140 --> 00:46.850 align:middle line:90%
We'd want to verify
that we have the IP

23
00:46.850 --> 00:48.980 align:middle line:90%
connectivity between the
server and the agent.

24
00:48.980 --> 00:53.000 align:middle line:90%
We'd also make sure that both
sides are configured correctly.

25
00:53.000 --> 00:56.380 align:middle line:90%
And if we want this agent
to be able to send messages

26
00:56.380 --> 00:59.030 align:middle line:90%
on demand, like things
that happen to send traps

27
00:59.030 --> 01:01.550 align:middle line:90%
or to the server, we'd want
to use the command SNMP
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
00:59.030 --> 01:01.550 align:middle line:90%
or to the server, we'd want
to use the command SNMP

28
01:01.550 --> 01:03.510 align:middle line:84%
dash server space host space.

29
01:03.510 --> 01:06.740 align:middle line:90%
And then the unit string
or the user information

30
01:06.740 --> 01:08.810 align:middle line:90%
based on the version of
SNMP that we're using.

31
01:08.810 --> 01:12.380 align:middle line:90%
That's another challenge is
what version are we using?

32
01:12.380 --> 01:14.150 align:middle line:90%
Because if the server
thinks that we're

33
01:14.150 --> 01:15.980 align:middle line:90%
using version
three and the agent

34
01:15.980 --> 01:18.320 align:middle line:90%
thinks we're using version
two, obviously that's

35
01:18.320 --> 01:19.150 align:middle line:84%
not going to work.

36
01:19.150 --> 01:20.840 align:middle line:90%
So we want to
verify that as well.

37
01:20.840 --> 01:23.560 align:middle line:90%
Another aspect that can cause
failures or lack of information

38
01:23.560 --> 01:27.080 align:middle line:90%
from moving back and forth
would be the correct MIB,

39
01:27.080 --> 01:28.743 align:middle line:84%
or the managed device.

40
01:28.743 --> 01:31.160 align:middle line:90%
So the management server needs
to have the appropriate MIB
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
01:28.743 --> 01:31.160 align:middle line:90%
So the management server needs
to have the appropriate MIB

41
01:31.160 --> 01:33.830 align:middle line:90%
or at least the MIB that's
going to give some of the data

42
01:33.830 --> 01:36.193 align:middle line:90%
from that device if we
want to pull and gather

43
01:36.193 --> 01:37.610 align:middle line:90%
that information
from that device.

44
01:37.610 --> 01:40.770 align:middle line:90%
So having the correct
MIB is also important.

45
01:40.770 --> 01:42.090 align:middle line:84%
Now another option is this.

46
01:42.090 --> 01:45.230 align:middle line:90%
What if this SNMP
agent is rebooted?

47
01:45.230 --> 01:47.650 align:middle line:90%
Or what if we add
new hardware to it?

48
01:47.650 --> 01:49.310 align:middle line:90%
There is interface
indexes that are

49
01:49.310 --> 01:51.330 align:middle line:90%
associated with the
interfaces on that router

50
01:51.330 --> 01:52.080 align:middle line:84%
or on that device.

51
01:52.080 --> 01:56.600 align:middle line:90%
So if we're tracking or
monitoring interface index

52
01:56.600 --> 01:58.790 align:middle line:90%
A, for example, and
then the next day

53
01:58.790 --> 02:02.090 align:middle line:90%
that same interface
becomes interface index B,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
01:58.790 --> 02:02.090 align:middle line:90%
that same interface
becomes interface index B,

54
02:02.090 --> 02:04.290 align:middle line:90%
the SNMP information is
not going to be consistent.

55
02:04.290 --> 02:05.960 align:middle line:90%
So there's another
command that I

56
02:05.960 --> 02:08.120 align:middle line:90%
would encourage you to
use as well with SNMP,

57
02:08.120 --> 02:09.550 align:middle line:84%
and that's this one.

58
02:09.550 --> 02:13.042 align:middle line:90%
And that is SNMP server
space IF index space persist.

59
02:13.042 --> 02:15.000 align:middle line:90%
And that's going to have
that information we're

60
02:15.000 --> 02:17.292 align:middle line:90%
going to need, the index
associated with the interfaces

61
02:17.292 --> 02:19.590 align:middle line:90%
persist even if you
reboot that device

62
02:19.590 --> 02:22.313 align:middle line:84%
or if you add new interfaces.

63
02:22.313 --> 02:23.730 align:middle line:90%
Index numbers for
those interfaces

64
02:23.730 --> 02:24.600 align:middle line:90%
are going to stay
the same, which

65
02:24.600 --> 02:26.933 align:middle line:90%
is going to give you consistent
data over time regarding

66
02:26.933 --> 02:27.880 align:middle line:84%
those interfaces.

67
02:27.880 --> 02:29.483 align:middle line:90%
So that's an
important one as well.

68
02:29.483 --> 02:30.900 align:middle line:90%
And a lot of the
troubles can come
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

68
02:29.483 --> 02:30.900 align:middle line:90%
And a lot of the
troubles can come

69
02:30.900 --> 02:33.120 align:middle line:90%
into place with SNMP
version three simply

70
02:33.120 --> 02:34.930 align:middle line:84%
because there's so many options.

71
02:34.930 --> 02:40.890 align:middle line:90%
So if we're doing AUTH PRIV,
which implies authentication

72
02:40.890 --> 02:42.840 align:middle line:90%
and data encryption,
we want make sure

73
02:42.840 --> 02:45.090 align:middle line:90%
that all the settings
are matched up

74
02:45.090 --> 02:47.220 align:middle line:90%
between the server
and the agent.

75
02:47.220 --> 02:50.490 align:middle line:90%
That would include the passwords
used for authentication

76
02:50.490 --> 02:52.320 align:middle line:90%
and the password
used for encryption,

77
02:52.320 --> 02:54.440 align:middle line:90%
the method of the
authentication, which

78
02:54.440 --> 02:58.000 align:middle line:90%
would be Shaw or MD5, the
method for the encryption,

79
02:58.000 --> 02:59.910 align:middle line:90%
which could be AES
with a key length,

80
02:59.910 --> 03:02.640 align:middle line:90%
or if you have an older device
that's not compatible with AES,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

80
02:59.910 --> 03:02.640 align:middle line:90%
or if you have an older device
that's not compatible with AES,

81
03:02.640 --> 03:04.620 align:middle line:90%
you might have to use
DEZ or something less.

82
03:04.620 --> 03:07.650 align:middle line:90%
So you want to share all
those details are in line

83
03:07.650 --> 03:09.180 align:middle line:90%
and synced up between
the management

84
03:09.180 --> 03:12.060 align:middle line:90%
server and the client
if you want it to work.

85
03:12.060 --> 03:13.860 align:middle line:90%
And a great option
in troubleshooting

86
03:13.860 --> 03:16.200 align:middle line:90%
is to ask ourselves, when's
the last time this worked?

87
03:16.200 --> 03:19.400 align:middle line:90%
Now if you're standing up a
brand new SNMP relationship

88
03:19.400 --> 03:20.820 align:middle line:90%
and it's never
been in place, you

89
03:20.820 --> 03:23.370 align:middle line:90%
might want to consider
doing SNMP version two

90
03:23.370 --> 03:25.475 align:middle line:90%
and just verifying
basic functionality

91
03:25.475 --> 03:26.600 align:middle line:84%
with the community strings.

92
03:26.600 --> 03:28.950 align:middle line:90%
And if that works, then you
can tear that piece down.

93
03:28.950 --> 03:31.230 align:middle line:90%
And then instead replace
it with the SNMP version
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

93
03:28.950 --> 03:31.230 align:middle line:90%
And then instead replace
it with the SNMP version

94
03:31.230 --> 03:33.630 align:middle line:90%
three with the
views and the groups

95
03:33.630 --> 03:36.057 align:middle line:90%
and the users in those
groups or access.

96
03:36.057 --> 03:37.890 align:middle line:90%
Because sometimes if
people are implementing

97
03:37.890 --> 03:41.310 align:middle line:90%
SNMP version three for the first
time and it's not connecting,

98
03:41.310 --> 03:44.160 align:middle line:90%
there are a lot of moving
parts with the user pieces

99
03:44.160 --> 03:45.990 align:middle line:84%
and the groups and the views.

100
03:45.990 --> 03:48.750 align:middle line:90%
So basic functionality
first with SNMP version two

101
03:48.750 --> 03:50.097 align:middle line:84%
is not a bad idea.

102
03:50.097 --> 03:51.930 align:middle line:90%
And then once you have
a comfort level, yes.

103
03:51.930 --> 03:54.042 align:middle line:90%
Connectivity works, the
basic functionality works.

104
03:54.042 --> 03:55.500 align:middle line:90%
And maybe when you
up the ante, you

105
03:55.500 --> 03:57.980 align:middle line:90%
don't start with all the
features of SNMP version three.

106
03:57.980 --> 03:59.730 align:middle line:90%
You can add the
individual security pieces

107
03:59.730 --> 04:02.490 align:middle line:90%
for authentication and
privacy for encryption one
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

107
03:59.730 --> 04:02.490 align:middle line:90%
for authentication and
privacy for encryption one

108
04:02.490 --> 04:04.990 align:middle line:90%
at a time just to verify it's
all going to come into place.

109
04:04.990 --> 04:06.990 align:middle line:90%
And one more element thing
that can just bite us

110
04:06.990 --> 04:09.390 align:middle line:90%
is if we have an access
control list that's

111
04:09.390 --> 04:11.160 align:middle line:90%
associated with
either SNMP version

112
04:11.160 --> 04:14.610 align:middle line:90%
two or three on the agent, if
that access control list is not

113
04:14.610 --> 04:16.470 align:middle line:90%
permitting the
network management

114
04:16.470 --> 04:19.800 align:middle line:90%
server to connect to it,
that's also going to prevent

115
04:19.800 --> 04:21.750 align:middle line:84%
successful SNMP services.

116
04:21.750 --> 04:23.880 align:middle line:90%
So you might want to
do it without the ACL

117
04:23.880 --> 04:26.070 align:middle line:90%
to begin with as you're
warming up to the idea

118
04:26.070 --> 04:27.460 align:middle line:90%
or setting up for
the first time.

119
04:27.460 --> 04:30.440 align:middle line:90%
Then once you verify the
connectivity, add the ACL,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

119
04:27.460 --> 04:30.440 align:middle line:90%
Then once you verify the
connectivity, add the ACL,

120
04:30.440 --> 04:33.460 align:middle line:90%
verify it still works, and then
continue to build from there.

121
04:33.460 --> 04:36.090 align:middle line:90%
So thanks for joining me in
this video about several things

122
04:36.090 --> 04:39.210 align:middle line:90%
that can go bump in the
night regarding SNMP and how

123
04:39.210 --> 04:40.060 align:middle line:84%
to resolve them.

124
04:40.060 --> 04:41.810 align:middle line:90%
So I'll see you in the
next set of videos.

125
04:41.810 --> 04:44.010 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

126
04:44.010 --> 04:47.280 align:middle line:90%
And I'd like to thank
you for viewing.