SNMP version 2C is fairly straightforward because it
doesn't have a lot of details regarding
encryption and authentication because it doesn't do it.
However, it does require doing a little bit
of setup at the router and also a little bit of setup
on the NMS, the network management station.
And I'd like to share with you a demonstration of both of those
and how we can verify that SNMP is indeed working.
Here's our topology for this demonstration.
This router right here, router one,
is going to be a literal router called KB-LSV-RTR-A, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is going to be a literal router called KB-LSV-RTR-A,
and that is its hostname.
And it's connected to a cloud.
And out there we've got a network management
server that is going to manage this via SNMP.
So on this device, we're going to use SNMP version
2C, which is really simple.
We're just going to have a community string for read
only or read/write access. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
only or read/write access.
We'll then tell the network management server
about that IP address and what those things are.
And as long as they have connectivity
and they can reach each other, the network management server
can start pulling that device.
And assuming we're using the right management information
base, it can then go into very nitty gritty detail
about that device, querying information and then
displaying it in the network management system
so we can use it.
All right.
So let's take a look at the router config for SNMP
and then we'll take a look at the management server.
So here we are at the router.
It's going to be the SNMP agent for version 2C. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It's going to be the SNMP agent for version 2C.
And if we do a show run, pipe, and I've
already got this set up.
I'll do a show run pipe.
And we'll include SNMP.
And then I'm going to have to blur out a few of the details,
including the community string that I don't
want to disclose to the world.
All right, so let's press Enter.
All right.
So with a little bit of blur on this output
to protect the innocent, if we want to set up an SNMP
agent out for version 2C on the router,
it would simply be SNMP server, space, the keyword community, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it would simply be SNMP server, space, the keyword community,
space, and then the name of the community
string we want to use.
And so it would be Cisco!23, or whatever you want that string
to be.
Something a little more secure this would be a great idea.
Space, and then we're going to specify
whether it's a read only unity string with RO,
or is it read/write.
Ta da.
We now have a community string.
And the other details about location or contact WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And the other details about location or contact
is above and beyond what's needed
for the basic requirements for an SNMP manager
to go ahead and connect to this SNMP agent.
Now in addition to this, and what
we should do in a production environment,
is we can throw in an access control
list at the end of this SNMP statement
for the community specifying where the source addresses are
allowed to come from.
So if we know we have two or three SNMP servers
or management servers and we know what IP addresses they are
or the subnet they're in, we'd want to explicitly permit WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or the subnet they're in, we'd want to explicitly permit
those, and that way just not anybody
can try to attempt to access this with SNMP.
So an attacker, if they can't get access
based on an ACL logically applied for SNMP,
they're not even going to have a chance
to do a brute force attack with lots of different passwords.
That's a good security measure, especially with SNMP version
2C, where we don't have a whole bunch of security
outside of that ACL and the community string
that we specified as the password for that access.
So next, let's take a look at an SNMP manager WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So next, let's take a look at an SNMP manager
that has the ability using this community string for read/write
to connect to this box and make requests and also set elements
based on having the correct management information
base for this router.
So this is an example of a free SNMP manager.
It also does a few other cool things.
But for this purpose, SNMP management.
And it's called Observium.
Oh my gosh, it is so amazing.
So what we're looking at here is the details
for that specific Cisco router that we just looked WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
for that specific Cisco router that we just looked
at its SNMP configuration for.
So to configure the manager to talk to that router,
we would go to the settings.
And the interface might look slightly different based
on the manager you're using.
But we specify the protocol version.
Version 2C is what we're using.
And in the next video, we'll take a look
at SNMP version 3 including the configuration to make it work.
So this one's SNMP version 2C.
Transport protocol is using the default of UDP port 161.
And then I simply supplied the SNMP community,
which I grayed out on the previous screen. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
which I grayed out on the previous screen.
So I don't think I want to click and show that password here.
So with SNMP version 2, the only option we have for security
is this community string, which I'm using right here.
And if we also want to tack on an access list
at the end of that configuration on the router,
that would also protect based on the addresses where the SNMP
manager could come in from.
And I got to tell you that SNMP is so--
it's amazing about what it can collect.
For example, if we click on MIBs right here,
the management information base, I didn't actually WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the management information base, I didn't actually
tell this management system that it was a specific Cisco router
and you could use this specific MIB.
What it did was, it did a couple of fairly generic queries,
found out what the device was, and then made
a bunch of estimated guesses on the MIBs associated
with that device.
It's amazing.
So here all the device MIBs that it
is using to communicate with that device.
And so what it can do is it can have
all these MIBs and then test.
So each MIB, think of it like a dictionary
of how to get to the individual components. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
of how to get to the individual components.
And so it enable a MIB, tried it, and then
if a whole bunch of stuff failed,
it could say nothing matches here.
I'm not going to use that MIB.
And based on its trial and error here, look--
and also educated guess on based on the type of device,
look at all these MIBs that it's using.
And as an administrator, if you thought, you know what?
There's a few MIBs in here that are not
appropriate for that device that aren't going to be effective,
we could go ahead and just disable them.
Not use them.
So an intelligent network management system,
including Observium, which is free,
it does an amazing job of going in, identifying WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it does an amazing job of going in, identifying
which MIBs are correct, and then actually using
those to query the device.
So based on that, I mean, check this out.
Here's the overview page.
So all this information--
this is a 2801 router that I literally
had I think in a closet for more than a year.
And I dusted it off, brought it up, put it online.
It's so fun.
I also have a couple more advanced routers
which I'll be using in the next video with SNMP version 3.
So it shows the hardware vendor, the version WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So it shows the hardware vendor, the version
of software running on it.
And all of these details here, it got,
I should say the network management system got, via SNMP
and pulling that device and asking, please
tell me about this and please tell me about that.
And all this information is fed back via SNMP with SNMP
version 2 that we just configured or looked
at on the router itself.
It really is amazing, the amount of information
that can be gleaned via SNMP.
It's showing us the interface going up and down.
I've got some BGP status on that device. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I've got some BGP status on that device.
Am I running BGP on that device?
I must be, because the SNMP is reporting
what's going on with it.
So if we go back to that router and just show
IP BGP S2 summary, yeah, sure enough, I've got 67 prefixes.
And there they go.
Or show BGP and IPV for Unicast.
Enter.
Yet another way to look at it.
So that command is the newer way.
But the show IP BGP also still works. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But the show IP BGP also still works.
So in any event, that SNMP manager
is collecting information on issues and problems
from this device.
And I haven't even yet specified where to send traps
or informs to from this device.
So all that information on the network manager
is being seen from pulling this device periodically.
And a few minutes ago, I modified
the contact information regarding
the SNMP config on the router.
And it just pulled again and now it's updated as well.
So I mean, it's just really amazing
all the detail that can be gleaned WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
all the detail that can be gleaned
via SNMP, processor information, memory, storage,
networks statistics.
Also if we go to configuration.
Again, the actual interface for the manager
isn't as important as what some of the functionality
is that it provides.
We go to properties here for this specific router,
it will once again have the SNMP configuration
if we made a change.
So for troubleshooting, and we think the password is wrong,
we could verify, or we even set the password on the router WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we could verify, or we even set the password on the router
and set the password in the manager
just to verify that it's working.
And then for MIBs, we could also verify
that we have the right MIB for that model of device.
There's a MIB lookup tool at Cisco.
So if I was running iOS version x on a platform y,
I could look that up.
Make sure I have the exact correct MIB for the network
management system to interface and connect and work
with that managed device.
Now as fun as SNMP version 2 is, it's not very secure.
Because the only thing that's protecting us
against an attacker is an access list displaying the source WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
against an attacker is an access list displaying the source
address of who can connect, which an attacker
could spoof and make it look like it's
coming from someone else, and then do a denial of service
attack, as well as the password, the community string that we're
using to manage that device.
So in the next video, we'll kick it up a notch.
And like to walk you through the configuration and verification
of both the client and the server
in working with SNMP version 3, which provides authentication
and encryption.
So I'll see you in that next video in just a moment.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And I'd like to thank you for viewing.