SNMP is a fairly sizable topic, and our focus needs to be on how we end up
deploying this
into our networks rather than necessarily the nitty-gritty of how it all comes
together.
But it's still useful for us to know exactly how it works.
A simple network management protocol is what it stands for, typically not
viewed as very
simple, which is why these days SNMP is getting phased out in favor of APIs and
systems that
leverage them.
However, it is still actively deployed today. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
However, it is still actively deployed today.
SNMP is intended to allow us to do automated remote management.
For example, it can get configuration information or statistical information or
just data from
a device.
We can also set configuration so I could configure a device to change, maybe it
's, I don't know,
cost on a network link to balance, to do better load balancing, it could change
access point,
transmit power, those kinds of things, and it can also importantly be used to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
transmit power, those kinds of things, and it can also importantly be used to
send alerts,
usually via what's known as traps.
So it's a trap joke, but it's a trap.
It's going to trigger an alert and allow us to proactively understand that
something is
happening on our network.
Now SNMP has a specific framework for how it comes together.
And it's typically going to be run by something called a network management
system or a network WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
system or a network
management station, just depending on how you interpret NMS.
But the idea here is typically we're going to use a software package on our
network,
which is going to be at the heart of our SNMP operation.
One of the reasons why we rely so heavily on this is because SNMP again is not
simple,
it is fairly complex.
The way it comes together is we have a network device like a router or a switch
, and these
are going to run an SNMP agent. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
are going to run an SNMP agent.
Now this is not an agent we have to install with Cisco, it's integrated into
iOS XE,
but at the same time the agent is running there on the network device.
On this system there's going to be a management information base or a MIB.
And this is going to define the SNMP capabilities of the system.
This is a tree of variables and data points that are known as object
identifiers or OIDs. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
identifiers or OIDs.
These are not particularly human readable.
It's just a long string of numbers.
And this is again where some of the simplicity we see doesn't actually exist.
But the idea here is that we're going to use these identifiers to send and
receive information
from a centralized device, and this is where the NMS comes into play.
This is again a software package that we as the admins typically are going to
be able
to log into.
Most commonly, via graphical user interface. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Most commonly, via graphical user interface.
And then ideally it also again is able to send us alerts when things aren't
quite behaving
appropriately.
So I could just use this to get alerts, visualize the network status,
understand how things are
going.
But I could also again push configuration down to these devices if I so desire.
Maybe just performing a software upgrade would be a good example of something I
can do with
a centralized NMS using SNMP. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
a centralized NMS using SNMP.
Now we mentioned these alerts and I already mentioned the concept of traps.
But actually there's a different type of trap called an inform.
And this is usually what we're actually going to use in our production
environments.
So let's talk about that.
These traps are designed to give us information without asking for it.
So typically we're going to say, hey, I want this information and the device
responds back.
But what if there's something really bad, a little explosion there on this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But what if there's something really bad, a little explosion there on this
device?
Something bad happened.
Well now I want to be proactive.
I don't want to have to wait as the network device.
I don't want that device to wait for me to ask it what's happening.
I want it to send me that proactive alert.
However, this device needs to understand what constitutes an emergency that I
need to send
an alert.
So this is a trap and an inform.
They both accomplish the same thing just in slightly different ways. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
They both accomplish the same thing just in slightly different ways.
A trap gets sent without an acknowledgment requirement.
Meaning that it's going to send this trap to the NMS, but if it gets lost, an
SNMP often
runs on UDP.
So if it gets lost in transit, then that NMS is not going to receive it.
Whereas an inform gets sent with the expectation of an acknowledgment.
Meaning that the NMS has to send that acknowledgment back for informs. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Meaning that the NMS has to send that acknowledgment back for informs.
And if the device doesn't receive an inform in a certain amount of time, it's
going to
send that alert again.
So informs are actually usually what we want to use for critical situations and
critical
problems.
Whereas traps would be maybe more useful for lighter things that we want to
report that
don't require as much CPU overhead and generating as much network traffic.
But generally speaking, in production networks, it makes sense to set up WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But generally speaking, in production networks, it makes sense to set up
informs over traps.
So that is our SNMP architecture.
Now we need to understand that there are different SNMP versions.
And in the modern network, there should really only be one version and yet
there are still
two versions that we see.
Version two C and version three.
Version three is what we should absolutely be deploying into our networks
anytime we're
setting up a new SNMP architecture.
And the reason for that is primarily because of security. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And the reason for that is primarily because of security.
Version three added much needed security that version two C simply didn't have.
And so when we're setting up secure networks, SNMP as we see has a lot of
control and capability
over what our network is doing.
We can get information from it and we can even configure the network via SNMP.
If SNMP gets compromised, our networks are in a lot of trouble.
And so security should be at the forefront of any conversation where we're WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so security should be at the forefront of any conversation where we're
deploying
SNMP.
Now that said, version two C is a whole lot more simple.
And this is why unfortunately we see a lot of networks going with it.
We see network admins setting up version two C because it's simple.
We know how to configure it.
It's very straightforward, whereas version three is a whole lot more complex to
set up.
But that's not an excuse.
We need to make sure that we take ownership of understanding how version three WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We need to make sure that we take ownership of understanding how version three
comes together
and what that looks like.
So because of version two C being out there so much, let's just spend a few
minutes talking
about it.
So version two C is secured with air quotes because it's not super secured.
But it's secured between our NMS and our device out here.
And it's going to use what's known as a community string. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And it's going to use what's known as a community string.
The community string is supposed to be a password that is shared between the N
MS and the device.
So only in theory, only the NMS should be able to control and get information
from that
networking device.
Here's the problem.
This string is sent in plain text.
We are not doing any kind of sophisticated encryption of this.
We're not exchanging keys.
We're not doing anything besides just saying, hey, I should have access to you. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We're not doing anything besides just saying, hey, I should have access to you.
Here's the password in plain text.
And these community strings are tied to either read only operation or read
write operation.
And so the device has this configured.
So hey, I've got an NMS that does read only operations.
I'm going to give it the read only community string that tells the device that,
hey, I'm
supposed to use or it's allowed to access me, but it's not allowed to configure
me versus
read write can do both.
Now the one good news in this from a security perspective is we can add an WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now the one good news in this from a security perspective is we can add an
access control
list to say only this IP address should be able to access me via SNMP.
So if we do have an environment that requires version 2C, we just we can't
reconfigure the
whole network and we're adding devices fine, but make sure that we're adding an
ACL to
every single device so that at least only the IP address for our NMS and other WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
every single device so that at least only the IP address for our NMS and other
systems
that require it will be able to access the device via SNMP.
But as we might imagine, it would be best not to use V2C at all and instead use
version
3.
So what does version 3 give us?
Well, what doesn't it give us?
It gives us integrity, which sounds like, okay, great.
It's more honest, but data integrity means that no bits have been flipped.
There's no man in the middle attack happening.
That's really important for a security perspective. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
That's really important for a security perspective.
And then other common security functionalities that we've talked about
throughout this course,
authentication and encryption, all of this is included with version 3.
Furthermore, it's going to use the concept of user accounts.
So we're basically performing logins that's going to allow us to take advantage
of these
different security functions.
Now these logins can be configured locally.
So we can have local user names and passwords on the device that the SNMP or WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we can have local user names and passwords on the device that the SNMP or
really the NMS
is going to leverage.
However, we can also take advantage of something like EAP and RADIUS in order
to fully authenticate
our users as well as to scale out when we have users we want to authenticate,
but then
that user leaves the organization.
We want to remove that user whole lot nicer to have that in a RADIUS server
than to have
it locally configured on every single device in the network.
So the local is really typically more intended to be used as a backup system in WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So the local is really typically more intended to be used as a backup system in
case the
network is down and we don't have access to the RADIUS server.
But again, SNMP, not super simple, but the framework is there and we see it.
We've pretty much every corporate enterprise network is going to have some kind
of NMS deployed
to take advantage of SNMP.
It's not a bad thing to use SNMP on the network.
We just are seeing that SNMP is getting replaced by more sophisticated systems WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We just are seeing that SNMP is getting replaced by more sophisticated systems
these days.
And if we are deploying SNMP at a very minimum level, make sure we're deploying
access control
lists with V2C if that's what's in place.
However, the strong preference is going to be that we're deploying SNMP version
3 any
chance we get.