Typical SNMP Configuration

SNMP Overview

The Simple Network Management Protocol (SNMP) is a standard network management protocol widely used on TCP/IP networks. SNMP manages network elements by using a central computer (a network management station) running network management software.

SNMP has the following advantages:

• Automatic configuration management:

  A network administrator can use SNMP to quickly query information, modify data, locate faults, and so forth on any SNMP agent. SNMP greatly improves work efficiency of network administrators.

• Multi-vendor management:

  SNMP shields the physical differences between devices of different vendors. SNMP provides only a basic function set, so the managed tasks are separated from the managed physical features and lower-layer interoperation technologies. Therefore, SNMP can uniformly manage devices of multiple vendors simultaneously.

SNMP is available in three versions. SNMPv1 is the initial version of SNMP. It provides authentication based on community names. SNMPv1 has low security, and can return only a few error codes. SNMPv2c issued by IETF is the second release of SNMP. SNMPv2c has enhancements to standard error codes, data types (Counter 64 and Counter 32), and operations including GetBulk and Inform. SNMPv2c does not improve the security, so IETF issued SNMPv3 that provides encryption and authentication based on the user-based security model (USM) and access control based on the view-based access control model (VACM).

SNMPv1 is applicable to small networks with simple networking and low security requirements or small networks with good security and stability, such as campus networks and small enterprise networks.

Configuration Notes

This configuration example applies to all switches running all versions.

In this example, eSight running V300R007C00 is used as the NMS.

Networking Requirements

As shown in Figure 3-268, the NMS server manages all devices on the network. The network is small and not likely to be attacked, so SNMPv1 is configured on switches to communicate with the NMS server. A new switch is added to the network. The network administrator wants to use the existing network resources to manage the new switch and quickly locate and rectify network faults.

Figure 3-268 Configuring a device to communicate with the NMS using SNMPv1

Configuration Roadmap

The configuration roadmap is as follows:

1. Configure SNMPv1 on the switch so that the NMS running SNMPv1 can manage the switch.

2. Configure access control so that only the NMS with the specified IP address can perform read/write operations on the specified MIB objects of the switch.

3. Configure a community name based on which the switch permits access of the NMS.

4. Configure a trap host and enable the switch to automatically send traps to the NMS.

5. Add the switch to the NMS. The community name configured on the switch must be the same as that used by the NMS; otherwise, the NMS cannot manage the switch.

SNMP Overview

The Simple Network Management Protocol (SNMP) is a standard network management protocol widely used on TCP/IP networks. SNMP manages network elements by using a central computer (a network management station) running network management software.

SNMP has the following advantages:

• Automatic configuration management:

  A network administrator can use SNMP to quickly query information, modify data, locate faults, and so forth on any SNMP agent. SNMP greatly improves work efficiency of network administrators.

• Multi-vendor management:

  SNMP shields the physical differences between devices of different vendors. SNMP provides only a basic function set, so the managed tasks are separated from the managed physical features and lower-layer interoperation technologies. Therefore, SNMP can uniformly manage devices of multiple vendors simultaneously.

SNMP is available in three versions. SNMPv1 is the initial version of SNMP. It provides authentication based on community names. SNMPv1 has low security, and can return only a few error codes. SNMPv2c issued by IETF is the second release of SNMP. SNMPv2c has enhancements to standard error codes, data types (Counter 64 and Counter 32), and operations including GetBulk and Inform. SNMPv2c does not improve the security, so IETF issued SNMPv3 that provides encryption and authentication based on the user-based security model (USM) and access control based on the view-based access control model (VACM).

SNMPv2c is applicable to medium and large networks with low security requirements or with good security (for example, VPNs) but on which services are so busy that traffic congestion may occur.

Configuration Notes

This configuration example applies to all switches running all versions.

In this example, eSight running V300R007C00 is used as the NMS.

Networking Requirements

As shown in Figure 3-269, the NMS server manages all devices on the network. The network is large and secure but the service traffic volume on the network is high. Therefore, devices on the network use SNMPv2c to communicate with the NMS server. For capacity expansion, a new switch is added to the network. The network administrator wants to use the existing network resources to manage the new switch and quickly locate and rectify network faults.

Figure 3-269 Configuring a device to communicate with the NMS using SNMPv2c

Configuration Roadmap

The configuration roadmap is as follows:

1. Configure SNMPv2c on the switch so that the NMS running SNMPv2c can manage the switch.

2. Configure access control so that only the NMS with the specified IP address can perform read/write operations on the specified MIB objects of the switch.

3. Configure a community name based on which the switch permits access of the NMS.

4. Configure a trap host and enable the switch to automatically send traps to the NMS.

5. Add the switch to the NMS. The community name configured on the switch must be the same as that used by the NMS; otherwise, the NMS cannot manage the switch.

SNMP Overview

The Simple Network Management Protocol (SNMP) is a standard network management protocol widely used on TCP/IP networks. SNMP manages network elements by using a central computer (a network management station) running network management software.

SNMP has the following advantages:

• Automatic configuration management:

  A network administrator can use SNMP to quickly query information, modify data, locate faults, and so forth on any SNMP agent. SNMP greatly improves work efficiency of network administrators.

• Multi-vendor management:

  SNMP shields the physical differences between devices of different vendors. SNMP provides only a basic function set, so the managed tasks are separated from the managed physical features and lower-layer interoperation technologies. Therefore, SNMP can uniformly manage devices of multiple vendors simultaneously.

SNMP is available in three versions. SNMPv1 is the initial version of SNMP. It provides authentication based on community names. SNMPv1 has low security, and can return only a few error codes. SNMPv2c issued by IETF is the second release of SNMP. SNMPv2c has enhancements to standard error codes, data types (Counter 64 and Counter 32), and operations including GetBulk and Inform. SNMPv2c does not improve the security, so IETF issued SNMPv3 that provides encryption and authentication based on the user-based security model (USM) and access control based on the view-based access control model (VACM).

SNMPv3 is applicable to networks of various scales, especially networks that have strict security requirements and can be managed only by authorized network administrators. For example, SNMPv3 can be used if data between the NMS and managed device needs to be transmitted over a public network.

Configuration Notes

This configuration example applies to all switches running all versions.

In this example, eSight running V300R007C00 is used as the NMS.

Networking Requirements

As shown in Figure 3-270, the NMS server manages all devices on the network. The network is large and is prone to attack. Therefore, devices on the network use SNMPv3 to communicate with the NMS server. A new switch is added to the network. The network administrator wants to use the existing network resources to manage the new switch and quickly locate and rectify network faults.

Figure 3-270 Configuring a device to communicate with the NMS using SNMPv3

Configuration Roadmap

The configuration roadmap is as follows:

1. Configure SNMPv3 on the switch so that the NMS running SNMPv3 can manage the switch.

2. Configure access control so that only the NMS with the specified IP address can perform read/write operations on the specified MIB objects of the switch.

3. Configure a user group and user based on which the switch permits access of the NMS.

4. Configure a trap host and enable the switch to automatically send traps to the NMS.

5. Add the switch to the NMS. The user group and user configured on the switch must be the same as those used by the NMS; otherwise, the NMS cannot manage the switch.

Introduction to eSight

eSight is a new-generation comprehensive operation, maintenance, and management solution developed by Huawei for network infrastructure management, unified communications, telepresence conferencing, video surveillance, and data center in enterprises. eSight supports unified monitoring and configuration management over devices of various types and from various vendors, monitors and analyzes network and service quality, manages enterprise resources, services, and users in a unified manner, and analyzes association between them. In addition, eSight offers a flexible and open platform that enables enterprises to customize software and build an intelligent management system tailored to their own needs. This example describes how a network administrator uses the Simple Network Management Protocol Version 2c (SNMPv2c) to automatically discover network devices on eSight.

Configuration Notes

This example uses eSight V200R005C00 and switch V200R003C00. The configurations may vary with software versions. For details, see the product manual of the corresponding version.

Networking Requirements

An enterprise administrator wants to use eSight to manage devices of the enterprise.

• The enterprise replans the network recently, and the number of devices on the entire network increases to about 1000. It is labor-consuming if the administrator logs in to each device to configure and manage the devices. The administrator needs to use a network management system (NMS) to uniformly manage all the devices on the network.
• Devices on the enterprise network belong to the R&D Dept and finance Dept, and devices in the R&D Dept are divided into two service groups. The R&D Dept has 800 devices and the finance Dept has 200 devices. The administrator wants to manage the devices by group, view the device status in different departments, and batch configure services for devices in the same service group during the maintenance process.

Figure 3-271 Networking of automatic device discovery

Requirement Analysis

• Enabling automatic device discovery: A large number of security devices and network devices need to be deployed on a network. The automatic device discovery function provided by eSight can reduce the administrator's workload, improve the operation efficiency, and lower misoperations.
• Selecting the SNMPv2c protocol: A majority of the security devices and network devices use SNMPv2c. SNMPv2c has higher security than SNMPv1, and is simple and easy to configure compared with SNMPv3.
• Enabling the subnet function in topology monitoring: The subnet function in topology monitoring enables eSight to monitor devices by area according to the subnet on which the devices are located. The administrator can divide the enterprise network into multiple subnets by department to implement differentiated management.
• Enabling the grouping function: During routine maintenance, the administrator needs to batch configure devices that provide similar services. The grouping function enables eSight to automatically add devices to different groups after grouping rules are set. The administrator can batch perform authentication and alarm filtering operations for devices in the same group.

Data Plan

Configuration Roadmap

1. Configure SNMP parameters on the devices.
2. Create subnets on eSight.
3. Set grouping rules on eSight.
4. Create an SNMP template on eSight.
5. Enable eSight to discover devices using SNMP.

Prerequisites

IP addresses have been configured for devices on the network according to Data Plan, and the devices can successfully communicate with eSight.