WEBVTT 00:00:00.000 --> 00:00:11.000 Alright folks, let's take this time to have a quick discussion on SNMP, Simple Network Management Protocol. 00:00:11.000 --> 00:00:17.000 So what we're dealing with here is a management protocol that we typically use to poll our devices. 00:00:17.000 --> 00:00:22.000 Why are we polling our devices? Like our routers, our switches, our servers, or any other device that supports SNMP, 00:00:22.000 --> 00:00:27.000 so we can collect and organize information about the health and well-being about them. 00:00:27.000 --> 00:00:35.000 You see, each of our devices that support SNMP has something known as the Management Information Base, the MIB. 00:00:35.000 --> 00:00:39.000 And the MIB is essentially a database that stores variables. 00:00:39.000 --> 00:00:42.000 Okay, what is variables? Information about very specific things. 00:00:42.000 --> 00:00:44.000 What specific things? Everything about our device. 00:00:44.000 --> 00:00:51.000 So for example, like your interface status, your five-minute CPU utilization, your two-minute CPU utilization, 00:00:51.000 --> 00:00:55.000 your five-second CPU utilization, the amount of memory that's being consumed, 00:00:55.000 --> 00:00:58.000 the amount of this, the amount of that, etc., etc., etc., etc. 00:00:58.000 --> 00:01:02.000 Pretty much anything you can do in the command line interface or verify in the command line interface, 00:01:02.000 --> 00:01:13.000 there is an SNMP variable in our MIB associated with that that we can use SNMP to poll and grab 00:01:13.000 --> 00:01:19.000 and have that information available to us on an SNMP network management system. 00:01:19.000 --> 00:01:26.000 So with SNMP, we have an NMS running SNMP management software, and then our devices are running an SNMP agent. 00:01:26.000 --> 00:01:33.000 And it's the communication between the SNMP server and the SNMP agent that uses SNMP, 00:01:33.000 --> 00:01:35.000 Sybil Network Management Protocol. 00:01:35.000 --> 00:01:39.000 And by default, we're using UDP port 161 for that communication. 00:01:39.000 --> 00:01:48.000 So we can configure our devices, because if you can modify a variable in the MIB, then you can configure, right? 00:01:48.000 --> 00:01:51.000 But you can also simply just poll and say, hey, give me information about this. 00:01:51.000 --> 00:01:52.000 Give me information about that. 00:01:52.000 --> 00:01:53.000 Give me the information you have about this. 00:01:53.000 --> 00:01:55.000 Give me the information you have about that. 00:01:55.000 --> 00:01:58.000 That would be polling the device and using it for monitoring purposes. 00:01:58.000 --> 00:02:02.000 So the agent is going to control access to the MIB on the devices. 00:02:02.000 --> 00:02:08.000 And our devices already come preloaded with the SNMP agent on them, our Cisco iOS devices. 00:02:08.000 --> 00:02:14.000 Now, the problem with this scenario for a lot of us is that there is a polling period. 00:02:14.000 --> 00:02:18.000 And so the polling period is going to be dependent on what you're trying to collect. 00:02:18.000 --> 00:02:22.000 So, for example, mission-critical information, you might want to poll more often. 00:02:22.000 --> 00:02:27.000 You might want to poll, like, maybe at a 15-second interval or a 30-second interval or maybe a 5-second interval. 00:02:27.000 --> 00:02:33.000 Whereas non-mission-critical information, you might be polling maybe a 5-minute interval, 1-day interval, whatever. 00:02:33.000 --> 00:02:40.000 So it's up to you to configure your NMS with the right polling interval for the information that you want to collect and when you want to collect it. 00:02:40.000 --> 00:02:44.000 But there are going to be times when you don't want to wait for that polling period no matter what for certain things. 00:02:44.000 --> 00:02:51.000 If something happens, an event on our device, a change of state, we want to know right away. 00:02:51.000 --> 00:02:54.000 And so that's where TRAPS and INFORMS come into play with SNMP. 00:02:54.000 --> 00:03:02.000 So with TRAPS and INFORMS, we have the ability to be notified right away as opposed to waiting for the polling period to get that information. 00:03:02.000 --> 00:03:06.000 So TRAPS is about pushing information, pushing information. 00:03:06.000 --> 00:03:09.000 INFORMS are about pushing information, pushing information. 00:03:09.000 --> 00:03:12.000 Whereas typical operation is to just poll. 00:03:12.000 --> 00:03:13.000 All right. 00:03:13.000 --> 00:03:16.000 So TRAPS and INFORMS, we have reliable and unreliable. 00:03:16.000 --> 00:03:18.000 So TRAPS are unreliable. 00:03:18.000 --> 00:03:20.000 INFORMS are reliable. 00:03:20.000 --> 00:03:21.000 Let me repeat that. 00:03:21.000 --> 00:03:22.000 TRAPS are unreliable. 00:03:22.000 --> 00:03:24.000 INFORMS are reliable. 00:03:24.000 --> 00:03:26.000 And you might be saying, oh, TCP, UDP. 00:03:26.000 --> 00:03:28.000 No, you're wrong. 00:03:28.000 --> 00:03:29.000 Not this time. 00:03:29.000 --> 00:03:30.000 No, sorry. 00:03:30.000 --> 00:03:32.000 So they're both using EDP. 00:03:32.000 --> 00:03:38.000 So it's UDP port 162. 00:03:38.000 --> 00:03:40.000 So polling uses UDP port 161. 00:03:40.000 --> 00:03:43.000 TRAPS and INFORMS use UDP port 162. 00:03:43.000 --> 00:03:47.000 So what makes, for example, the INFORM reliable and the TRAP unreliable? 00:03:47.000 --> 00:03:48.000 So think about it this way. 00:03:48.000 --> 00:03:52.000 A TRAP, we send the message, boom, done. 00:03:52.000 --> 00:03:55.000 So let's say our five-minute CPU utilization was 80%. 00:03:55.000 --> 00:03:56.000 Boom, send the message, we're done. 00:03:56.000 --> 00:03:57.000 We don't even care. 00:03:57.000 --> 00:03:58.000 That's it. 00:03:58.000 --> 00:03:59.000 It's over. 00:03:59.000 --> 00:04:01.000 So did the NMS get a yes or no? 00:04:01.000 --> 00:04:02.000 We don't know. 00:04:02.000 --> 00:04:03.000 We don't know. 00:04:03.000 --> 00:04:04.000 And as admin, we wouldn't know if it got it. 00:04:04.000 --> 00:04:06.000 We wouldn't even know this was going on then. 00:04:06.000 --> 00:04:13.000 So if you need reliable, then basically when that situation occurs, you send the INFORM, 00:04:13.000 --> 00:04:16.000 and then you're waiting for a reply from the server. 00:04:16.000 --> 00:04:19.000 If the server got it successfully, it replies back with, yeah, I got it. 00:04:19.000 --> 00:04:20.000 Good, thank you. 00:04:20.000 --> 00:04:21.000 That's it. 00:04:21.000 --> 00:04:22.000 Basically thumbs up. 00:04:22.000 --> 00:04:23.000 Think of it that way. 00:04:23.000 --> 00:04:26.000 If it doesn't respond, then I send it again. 00:04:26.000 --> 00:04:27.000 If it doesn't respond, I send it again. 00:04:27.000 --> 00:04:28.000 If it doesn't respond, I send it again. 00:04:28.000 --> 00:04:30.000 Then all of a sudden it responds back, yeah, I got it. 00:04:30.000 --> 00:04:31.000 Good. 00:04:31.000 --> 00:04:32.000 Perfect. 00:04:32.000 --> 00:04:33.000 Done. 00:04:33.000 --> 00:04:34.000 Now I can stop sending it. 00:04:34.000 --> 00:04:35.000 So that's all the INFORM does. 00:04:35.000 --> 00:04:37.000 It gives us the ability to have an acknowledgement. 00:04:37.000 --> 00:04:39.000 That's all it does. 00:04:39.000 --> 00:04:40.000 All right. 00:04:40.000 --> 00:04:44.000 So knowing port numbers is always a good thing for any Cisco certification exam. 00:04:44.000 --> 00:04:45.000 So there they are. 00:04:45.000 --> 00:04:47.000 So TRAPS and INFORMS are 162. 00:04:47.000 --> 00:04:49.000 The polling uses 161. 00:04:49.000 --> 00:04:53.000 You don't really need to know these messages for the exam, but these were the messages 00:04:53.000 --> 00:04:57.000 that were originally introduced with SNMP version 1. 00:04:57.000 --> 00:05:00.000 These were the ones that were added with version 2. 00:05:00.000 --> 00:05:08.000 The thing, though, is that most of us don't realize that version 2 was actually something 00:05:08.000 --> 00:05:13.000 that offered enhanced authentication, enhanced encryption, and it never took off because 00:05:13.000 --> 00:05:18.000 it was so complicated, but people still wanted these additional INFORM and GET BULK requests. 00:05:18.000 --> 00:05:21.000 That's why they invented version 2C. 00:05:21.000 --> 00:05:25.000 So version 2C doesn't mean A failed, B failed, we ended up with C in the end. 00:05:25.000 --> 00:05:26.000 No. 00:05:26.000 --> 00:05:31.000 C means community strings. 00:05:31.000 --> 00:05:33.000 So with SNMP version 1, we use community strings. 00:05:33.000 --> 00:05:36.000 With SNMP version 2C, we use community strings. 00:05:36.000 --> 00:05:37.000 And what is a community string? 00:05:37.000 --> 00:05:41.000 If you don't know, it's a shared password, a shared secret. 00:05:41.000 --> 00:05:44.000 That's all it is. 00:05:44.000 --> 00:05:46.000 Everything's in plain text. 00:05:46.000 --> 00:05:48.000 Keep that in mind. 00:05:48.000 --> 00:05:49.000 All right. 00:05:49.000 --> 00:05:53.000 So it's not until SNMP version 3 where we get more secure. 00:05:53.000 --> 00:05:55.000 And so with more security, we get what? 00:05:55.000 --> 00:05:59.000 Like enhanced authentication, integrity checking, encryption, authorization, all of that comes 00:05:59.000 --> 00:06:01.000 along with SNMP version 3. 00:06:01.000 --> 00:06:03.000 And we have three different security models. 00:06:03.000 --> 00:06:09.000 We've got no auth, we have auth, and we have priv. 00:06:09.000 --> 00:06:13.000 Now, many people fall into the trap because they're misled into thinking that no auth 00:06:13.000 --> 00:06:14.000 means no authentication. 00:06:14.000 --> 00:06:15.000 No, no, no, no. 00:06:15.000 --> 00:06:19.000 It simply means like no authenticity, no integrity checking, nothing like that, but we still 00:06:19.000 --> 00:06:20.000 have to authenticate. 00:06:20.000 --> 00:06:23.000 And we authenticate with what is called a username. 00:06:23.000 --> 00:06:26.000 So my device has to be configured with the same username as the NMS. 00:06:26.000 --> 00:06:27.000 Okay. 00:06:27.000 --> 00:06:31.000 Now, when I say username here, folks, we're talking about the SNMP username configuration. 00:06:31.000 --> 00:06:33.000 Essentially, it boils down to being a community string. 00:06:33.000 --> 00:06:34.000 That's all it is. 00:06:34.000 --> 00:06:36.000 So it's basically a shared password, a shared secret. 00:06:36.000 --> 00:06:37.000 Everything's in plain text. 00:06:37.000 --> 00:06:38.000 That's all it is. 00:06:38.000 --> 00:06:43.000 So it's really very similar to version 1 and version 2C when it's all said and done from 00:06:43.000 --> 00:06:44.000 a security standpoint. 00:06:44.000 --> 00:06:50.000 Auth now uses the username plus hashing algorithms. 00:06:51.000 --> 00:06:53.000 So now we get enhanced authentication. 00:06:53.000 --> 00:06:55.000 We get integrity checking as well. 00:06:55.000 --> 00:07:05.000 And then priv uses the username, the hashing algorithm, and an encryption algorithm. 00:07:05.000 --> 00:07:09.000 So now we get our enhanced authentication, our integrity checking, and our encryption 00:07:09.000 --> 00:07:11.000 for our privacy when it's all said and done. 00:07:11.000 --> 00:07:15.000 So the best one here is SNMP version 3 priv. 00:07:15.000 --> 00:07:19.000 I'm going to show you a couple of configs here now, one for 2C and one for version 3 00:07:19.000 --> 00:07:22.000 just to help you get in the right mindset for the certification exam. 00:07:22.000 --> 00:07:26.000 So that way there, if an SNMP config shows up, you have the ability to read through it. 00:07:26.000 --> 00:07:31.000 So we're not going to get into the nitty-gritty details of SNMP configuration and doing some 00:07:31.000 --> 00:07:32.000 fancy things with it. 00:07:32.000 --> 00:07:36.000 It's just basic, straightforward, fundamental here, just like you would alerts in CCNA. 00:07:36.000 --> 00:07:39.000 So first of all, I always love talking about the access control list because you have this 00:07:39.000 --> 00:07:42.000 server out here that is going to be your NMS. 00:07:42.000 --> 00:07:47.000 And you want to make sure that you are controlling who is allowed to connect to your MIB, 00:07:47.000 --> 00:07:49.000 who is talking to your agent. 00:07:49.000 --> 00:07:53.000 So because your server has an IP address, you might as well create an access control list that 00:07:53.000 --> 00:07:56.000 you can then call upon later on. 00:07:56.000 --> 00:08:01.000 So that way there, you only allow the server with this IP address to actually talk to you 00:08:01.000 --> 00:08:06.000 using SNMP. 00:08:06.000 --> 00:08:10.000 This line here, SNMP server community, this is setting up the community string on the 00:08:10.000 --> 00:08:11.000 device. 00:08:11.000 --> 00:08:15.000 So that would have to match whatever we decided to set up on the server for this scenario. 00:08:16.000 --> 00:08:17.000 So there you go. 00:08:17.000 --> 00:08:19.000 Notice it says read-only, RO. 00:08:19.000 --> 00:08:23.000 That means that this is for read-only communication. 00:08:23.000 --> 00:08:24.000 You cannot write. 00:08:24.000 --> 00:08:25.000 You cannot change variables. 00:08:25.000 --> 00:08:29.000 You can only read the variables and the information out of the MIB. 00:08:29.000 --> 00:08:33.000 Now, if you wanted to do read-write instead, you wouldn't need this line, of course. 00:08:33.000 --> 00:08:37.000 You would just need the next line, SNMP server community, and then have your password. 00:08:37.000 --> 00:08:40.000 So in this case, I typed in a different password there. 00:08:40.000 --> 00:08:43.000 And RW would have to be listed there. 00:08:43.000 --> 00:08:47.000 So that would be read-write, meaning you can pull from the MIB, but you can also change 00:08:47.000 --> 00:08:51.000 variables in the MIB as well with that configuration. 00:08:51.000 --> 00:08:52.000 You have traps. 00:08:52.000 --> 00:08:53.000 So what do we say? 00:08:53.000 --> 00:08:57.000 Traps give us the ability to push, push, push to the server. 00:08:57.000 --> 00:08:58.000 So what's the server's IP address? 00:08:58.000 --> 00:09:01.000 SNMP server host, 10.0.3.8. 00:09:01.000 --> 00:09:06.000 Traps, if we didn't want traps, then I could just type in informs there instead, informs. 00:09:06.000 --> 00:09:08.000 Version 2c in this case. 00:09:08.000 --> 00:09:09.000 And there's the community string. 00:09:10.000 --> 00:09:13.000 So that community string would have to be configured on the server as well. 00:09:13.000 --> 00:09:18.000 This last value here, if index persists, what does that mean? 00:09:18.000 --> 00:09:24.000 What we need to realize is that within SNMP, MIB, our database, every single one of our 00:09:24.000 --> 00:09:27.000 interfaces gets an index number associated with it. 00:09:27.000 --> 00:09:32.000 And you might use this index number for running your reports. 00:09:32.000 --> 00:09:34.000 You might actually be using it for polling. 00:09:34.000 --> 00:09:38.000 So let's say you decide that, hey, when I want to get interface statistics or interface 00:09:38.000 --> 00:09:42.000 information off the device, I am going to go to my NMS and I'm going to say, I want 00:09:42.000 --> 00:09:48.000 you to poll this particular device and get the information pertaining to index number 00:09:48.000 --> 00:09:51.000 four. 00:09:51.000 --> 00:09:56.000 The problem is, is that if these interfaces change, meaning let's say you add another 00:09:56.000 --> 00:10:00.000 interface, another loopback interface, or maybe you add another physical interface to 00:10:00.000 --> 00:10:05.000 the device, these numbers can change during a reboot. 00:10:05.000 --> 00:10:09.000 Now, in this case here, if we don't change the interface, if we don't add any extra 00:10:09.000 --> 00:10:15.000 loopback interfaces or tunnel interfaces or physical interfaces, when we reboot, they're 00:10:15.000 --> 00:10:18.000 going to be the same because this is what they were set up as. 00:10:18.000 --> 00:10:23.000 But if anything changes, then this can change because our device during a reboot assigns 00:10:23.000 --> 00:10:28.000 the index numbers based on a certain criteria that exists inside the actual product. 00:10:28.000 --> 00:10:32.000 So we could end up with different numbers during a reboot. 00:10:32.000 --> 00:10:37.000 And if that happens, imagine your next polling or the next statistical gathering you're trying 00:10:37.000 --> 00:10:41.000 to do of an interface, and now all of a sudden you're getting something from a different 00:10:41.000 --> 00:10:46.000 interface because it's now using the number that you were using on another interface. 00:10:46.000 --> 00:10:51.000 What if the new tunnel interface was four that you created and this old interface here 00:10:51.000 --> 00:10:53.000 is now maybe number seven? 00:10:53.000 --> 00:10:55.000 Well, that's no good, right? 00:10:55.000 --> 00:10:56.000 That's no good for you. 00:10:56.000 --> 00:11:01.000 So SNMP server if index persists means do not allow these numbers to ever change once 00:11:01.000 --> 00:11:02.000 they're assigned. 00:11:02.000 --> 00:11:03.000 That's all that means. 00:11:03.000 --> 00:11:04.000 And I know what you're thinking right now. 00:11:04.000 --> 00:11:06.000 Well, why isn't that the default? 00:11:06.000 --> 00:11:07.000 This seems rather silly, Raymond. 00:11:07.000 --> 00:11:09.000 Yeah, I know. 00:11:09.000 --> 00:11:10.000 I know. 00:11:10.000 --> 00:11:11.000 I agree with you. 00:11:11.000 --> 00:11:13.000 But, hey, it's what it is. 00:11:13.000 --> 00:11:19.000 So imagine having something as critical as this that is not the default. 00:11:19.000 --> 00:11:20.000 Hmm. 00:11:20.000 --> 00:11:22.000 Might I need to know that? 00:11:22.000 --> 00:11:23.000 Maybe. 00:11:23.000 --> 00:11:24.000 Just saying. 00:11:24.000 --> 00:11:25.000 All right. 00:11:25.000 --> 00:11:29.000 Let's look at our SNMP version three example. 00:11:29.000 --> 00:11:34.000 If you've never used SNMP version three, it can be a little bit complicated at the beginning 00:11:34.000 --> 00:11:37.000 only because there's a nesting that goes on here. 00:11:37.000 --> 00:11:44.000 So let's go ahead and this is our NMS, our IP address. 00:11:44.000 --> 00:11:48.000 So, again, an access control is a really great way to start your config. 00:11:48.000 --> 00:11:54.000 That way there you can apply it later on as we've done there. 00:11:55.000 --> 00:12:00.000 This is an example of you controlling what's allowed to actually be pulled. 00:12:00.000 --> 00:12:03.000 So it's another security essential parameter that we have here. 00:12:03.000 --> 00:12:05.000 It's called creating a view. 00:12:05.000 --> 00:12:06.000 What are we allowed to view? 00:12:06.000 --> 00:12:09.000 So if the server accesses me, what are they allowed to view? 00:12:09.000 --> 00:12:10.000 What are they allowed to look at? 00:12:10.000 --> 00:12:11.000 What are they allowed to gather? 00:12:11.000 --> 00:12:12.000 What are they allowed to pull? 00:12:12.000 --> 00:12:14.000 So I'm creating a custom view here. 00:12:14.000 --> 00:12:16.000 There are built-in views on our device. 00:12:16.000 --> 00:12:18.000 You'll see some of them a little later on today. 00:12:19.000 --> 00:12:26.000 But this custom view I called MGMT, and I am saying that you can only view the interface administrative status 00:12:26.000 --> 00:12:28.000 and the interface operational status. 00:12:28.000 --> 00:12:30.000 That's what that means. 00:12:30.000 --> 00:12:31.000 And I'm going to apply it where? 00:12:31.000 --> 00:12:33.000 I'm going to apply it right here. 00:12:33.000 --> 00:12:38.000 You're only allowed to read the interface admin status and the interface operational status 00:12:38.000 --> 00:12:41.000 if you are 10.0.3.8. 00:12:41.000 --> 00:12:44.000 That's what it's all coming down to here. 00:12:44.000 --> 00:12:47.000 So with that in mind now, what else do we have in this config? 00:12:47.000 --> 00:12:52.000 Well, here's my SNMP server group, and I didn't get very creative with the name. 00:12:52.000 --> 00:12:55.000 I just called it my test group for demonstration purposes. 00:12:55.000 --> 00:12:58.000 But this group is really what's bringing everything together. 00:12:58.000 --> 00:13:05.000 So this group called test is running SNMP version 3, and our security model is priv. 00:13:05.000 --> 00:13:09.000 Remember, we have no auth, we have auth, and we have priv. 00:13:09.000 --> 00:13:11.000 That is an option for SNMP version 3. 00:13:12.000 --> 00:13:16.000 So if it's no auth, then I only need a username for authentication. 00:13:16.000 --> 00:13:19.000 If it's auth, then I need a username and a hashing algorithm. 00:13:19.000 --> 00:13:23.000 And if it's priv, I need username, hashing algorithm, and encryption algorithm. 00:13:23.000 --> 00:13:25.000 So how do we specify it now? 00:13:25.000 --> 00:13:29.000 We specify it using our SNMP server user command. 00:13:29.000 --> 00:13:34.000 So you'll see here I created a user called user1, so user1 would have to be created here as well. 00:13:34.000 --> 00:13:37.000 And user1 is going to be used for my group test. 00:13:37.000 --> 00:13:39.000 Ah, look at that. 00:13:39.000 --> 00:13:41.000 Group test. 00:13:41.000 --> 00:13:45.000 There's my link, my nesting, my embedding that's going on here. 00:13:45.000 --> 00:13:48.000 And this user is going to be using version 3. 00:13:48.000 --> 00:13:50.000 So here's the deal now. 00:13:50.000 --> 00:13:55.000 If this said no auth instead, then that's it. 00:13:55.000 --> 00:13:58.000 I could stop right here because all I need is a username. 00:13:58.000 --> 00:14:00.000 I could stop right there. 00:14:00.000 --> 00:14:01.000 I have my username. 00:14:01.000 --> 00:14:02.000 It's user1. 00:14:02.000 --> 00:14:04.000 It matches what's on my server. 00:14:04.000 --> 00:14:07.000 But let's say it was auth instead. 00:14:07.000 --> 00:14:10.000 If it's auth, then we've got to go over here. 00:14:10.000 --> 00:14:20.000 So we have our username, and now we have our hashing algorithm, and then we have our shared secret, P-A-S-S-W-0-R-D. 00:14:20.000 --> 00:14:25.000 And if you're priv like we are, priv, then you need to go all the way. 00:14:25.000 --> 00:14:27.000 You also need your encryption algorithm. 00:14:27.000 --> 00:14:34.000 So we're using A-E-S-2-56-P-A-5-5-W-0-R-D. 00:14:34.000 --> 00:14:37.000 So let's look at the username now in its entirety. 00:14:37.000 --> 00:14:42.000 It says here SNMP user1 test group. 00:14:42.000 --> 00:14:43.000 It's for the test group. 00:14:43.000 --> 00:14:44.000 We're using version 3. 00:14:44.000 --> 00:14:48.000 And because the group is using priv, I need my hashing algorithm. 00:14:48.000 --> 00:14:51.000 My hashing algorithm is going to be SHA with a shared secret. 00:14:51.000 --> 00:14:59.000 And then we have our encryption algorithm, A-E-S-2-56, with that particular shared secret as well. 00:14:59.000 --> 00:15:04.000 So what's going to happen now is any time I am sending messages from my device to the server 00:15:04.000 --> 00:15:10.000 or the server is sending messages to my device, there's going to be a hash attached to the message 00:15:10.000 --> 00:15:16.000 for authentication and integrity checking, and everything's going to be encrypted as well. 00:15:16.000 --> 00:15:23.000 So now we have our encrypted communication and our hashing for integrity checking and authentication. 00:15:24.000 --> 00:15:27.000 Being enabled here, just like we did with version 2C example, 00:15:27.000 --> 00:15:32.000 and then setting up our device to send the traps to the server. 00:15:32.000 --> 00:15:35.000 So SNMP server host, 10.0.3.8 traps. 00:15:35.000 --> 00:15:39.000 If I want it to be informs, then we just type in informs instead of traps. 00:15:39.000 --> 00:15:40.000 Version 3. 00:15:40.000 --> 00:15:43.000 And because it's version 3, then we have to specify our security group. 00:15:43.000 --> 00:15:45.000 So is it no auth, auth, or priv? 00:15:45.000 --> 00:15:49.000 So not security group, but security model, I mean. 00:15:49.000 --> 00:15:51.000 So is it going to be no auth, auth, or priv? 00:15:51.000 --> 00:15:54.000 In this case, we're going with priv, the best option available. 00:15:54.000 --> 00:15:58.000 And then we're specifying user 1 because user 1 has the parameters that we need. 00:15:58.000 --> 00:16:01.000 They have the hashing algorithm and the encryption algorithm that we need. 00:16:01.000 --> 00:16:04.000 And let's not forget about if index persists. 00:16:04.000 --> 00:16:10.000 So if index persists is all about making sure that these numbers do not change during a reboot, 00:16:10.000 --> 00:16:13.000 whatever, ever, ever, ever. 00:16:13.000 --> 00:16:14.000 All right. 00:16:14.000 --> 00:16:17.000 All right, so to wrap this up, let's look at a few show commands. 00:16:17.000 --> 00:16:19.000 So show SNMP, not very exciting. 00:16:19.000 --> 00:16:24.000 But I did not actually have an SNMP server set up that I could send my stuff to in this particular example. 00:16:24.000 --> 00:16:26.000 So that's why everything says zero. 00:16:26.000 --> 00:16:30.000 But this would be about keeping track of the SNMP packets. 00:16:30.000 --> 00:16:33.000 So are there any errors? 00:16:33.000 --> 00:16:35.000 What are the PDUs responses? 00:16:35.000 --> 00:16:38.000 Trap PDUs, get requests, get next, and so on and so forth. 00:16:38.000 --> 00:16:43.000 So keeping track of those SNMP messages going back and forth from a statistical standpoint. 00:16:43.000 --> 00:16:46.000 Down here, it does show that SNMP logging is enabled. 00:16:46.000 --> 00:16:52.000 So this is where you can verify how many were sent, how many were dropped in regards to our logging to our server. 00:16:52.000 --> 00:16:55.000 So traps and inform messages. 00:16:55.000 --> 00:16:56.000 There is an example of our views. 00:16:56.000 --> 00:16:58.000 So we have some built-in views. 00:16:58.000 --> 00:17:00.000 And up here was the custom view that we created. 00:17:00.000 --> 00:17:03.000 Just by typing in show SNMP view, you can verify that. 00:17:03.000 --> 00:17:07.000 Show SNMP user, you can verify by typing in show SNMP user. 00:17:07.000 --> 00:17:11.000 So in this case, we have user one we created. 00:17:11.000 --> 00:17:14.000 And we created them to be used with the PRIV security model. 00:17:14.000 --> 00:17:15.000 So there's our hashing algorithm. 00:17:15.000 --> 00:17:16.000 There's our encryption algorithm. 00:17:16.000 --> 00:17:23.000 And it doesn't show the shared secret in this case because that would kind of, you know, be a little bit of a security concern if it did that as well. 00:17:23.000 --> 00:17:25.000 So it just shows our actual algorithms here. 00:17:25.000 --> 00:17:30.000 But it shows us which group we're connected to, and that's how you have to verify that. 00:17:30.000 --> 00:17:37.000 So to verify it, you have to look at, hey, what is the user, what are the users I have, 00:17:37.000 --> 00:17:41.000 and which group is listed with a user that matches the group that I have. 00:17:41.000 --> 00:17:49.000 So if we come over here, for example, we'll see here that with show SNMP group, here's my test group. 00:17:49.000 --> 00:17:59.000 So my test group, I have a user associated with it called user number one or user one. 00:17:59.000 --> 00:18:06.000 And if we look over here, we'll see that my security model for my test group is called version 3 PRIV, 00:18:06.000 --> 00:18:12.000 which means my user better have a hashing algorithm and they better have an encryption algorithm. 00:18:12.000 --> 00:18:16.000 So things maybe you might have to verify on a certification exam. 00:18:16.000 --> 00:18:17.000 What is missing in the config? 00:18:17.000 --> 00:18:18.000 Things like that, right? 00:18:18.000 --> 00:18:21.000 Become familiar with that config and what you need to do what with. 00:18:21.000 --> 00:18:23.000 Review management. 00:18:23.000 --> 00:18:24.000 So what is a review? 00:18:24.000 --> 00:18:26.000 If we have a right view, it would be listed there as well. 00:18:26.000 --> 00:18:29.000 And then lastly, our show SNMP host output. 00:18:29.000 --> 00:18:33.000 This is going to allow us to verify who we're sending traps or informs to. 00:18:33.000 --> 00:18:37.000 So you'll see 10.0.3.8, UDP port 162 for both traps and informs. 00:18:37.000 --> 00:18:38.000 So here it's traps. 00:18:38.000 --> 00:18:42.000 But if we had configured informs, it would show up as informs instead. 00:18:42.000 --> 00:18:44.000 And then our user. 00:18:44.000 --> 00:18:48.000 So which user are we using for this particular security model of version 3 PRIV? 00:18:48.000 --> 00:18:50.000 So user one. 00:18:50.000 --> 00:18:57.000 So does user one, because it's version 3 PRIV, have all the necessary parameters we need? 00:18:57.000 --> 00:18:58.000 Yes. 00:18:58.000 --> 00:18:59.000 We need our encryption algorithm. 00:18:59.000 --> 00:19:00.000 We need our hashing algorithm. 00:19:00.000 --> 00:19:02.000 And they are listed right there. 00:19:02.000 --> 00:19:09.000 So, folks, that is our coverage of SNMP for the Encore certification exam.