1 1 00:00:00,190 --> 00:00:03,820 The Simple Network Management Protocol or SNMP. 2 2 00:00:03,820 --> 00:00:05,680 In this lesson we're going to discuss 3 3 00:00:05,680 --> 00:00:07,950 the Simple Network Management Protocol. 4 4 00:00:07,950 --> 00:00:09,710 SNMP is an internet protocol 5 5 00:00:09,710 --> 00:00:11,690 for collecting and organizing information 6 6 00:00:11,690 --> 00:00:14,090 about managed devices on IP networks, 7 7 00:00:14,090 --> 00:00:15,800 and for modifying that information 8 8 00:00:15,800 --> 00:00:17,810 to change the devices behavior. 9 9 00:00:17,810 --> 00:00:19,530 When we talk about managed devices 10 10 00:00:19,530 --> 00:00:21,610 we're referring to any device that can communicate 11 11 00:00:21,610 --> 00:00:23,310 with an SNMP manager 12 12 00:00:23,310 --> 00:00:26,187 known as the management information base or MIB. 13 13 00:00:27,110 --> 00:00:29,570 Now this includes things like routers and switches 14 14 00:00:29,570 --> 00:00:31,840 and firewalls and printers and servers 15 15 00:00:31,840 --> 00:00:34,291 and even your end user client devices. 16 16 00:00:34,291 --> 00:00:36,630 SNMP can be used to send and receive data 17 17 00:00:36,630 --> 00:00:38,010 from these managed devices 18 18 00:00:38,010 --> 00:00:40,760 back to a centralized network management station. 19 19 00:00:40,760 --> 00:00:43,130 When you're configuring your SNMP architecture, 20 20 00:00:43,130 --> 00:00:45,940 you have to have a manager and then you have agents. 21 21 00:00:45,940 --> 00:00:48,730 Now the SNMP manager could be any machine on your network 22 22 00:00:48,730 --> 00:00:50,570 that's running the SNMP protocol 23 23 00:00:50,570 --> 00:00:52,120 to collect and process information 24 24 00:00:52,120 --> 00:00:54,510 from the devices on your LAN or WAN. 25 25 00:00:54,510 --> 00:00:57,160 Normally though, you're going to set this up on a server, 26 26 00:00:57,160 --> 00:00:59,810 especially in a large enterprise environment. 27 27 00:00:59,810 --> 00:01:01,960 Now, the agents are different network devices, 28 28 00:01:01,960 --> 00:01:03,910 they're sending information about themselves 29 29 00:01:03,910 --> 00:01:06,350 over the network, back to that manager. 30 30 00:01:06,350 --> 00:01:08,970 Usually an agent is just running a background service 31 31 00:01:08,970 --> 00:01:11,070 to collect the data and send it back to the manager 32 32 00:01:11,070 --> 00:01:14,090 at regular intervals, or when they're requested to do so 33 33 00:01:14,090 --> 00:01:15,550 by that manager. 34 34 00:01:15,550 --> 00:01:18,460 Now the SNMP manager is essentially a master node, 35 35 00:01:18,460 --> 00:01:20,870 and it's going to be able to send and receive these messages 36 36 00:01:20,870 --> 00:01:23,740 to those agents using three different message types. 37 37 00:01:23,740 --> 00:01:26,940 These are set, get, and trap messages. 38 38 00:01:26,940 --> 00:01:30,010 Now the set and get messages are pretty straightforward. 39 39 00:01:30,010 --> 00:01:32,630 The set request is a manager to an agent request, 40 40 00:01:32,630 --> 00:01:34,800 and it's going to change the value of a variable 41 41 00:01:34,800 --> 00:01:36,460 or a list of variables. 42 42 00:01:36,460 --> 00:01:38,360 When this request is received by the agent, 43 43 00:01:38,360 --> 00:01:40,670 it's going to update its variables to the latest status, 44 44 00:01:40,670 --> 00:01:42,740 and then provide a response to the manager 45 45 00:01:42,740 --> 00:01:45,530 with a list of all the new values for that variable. 46 46 00:01:45,530 --> 00:01:48,240 A get request is a manager to agent requests to retrieve 47 47 00:01:48,240 --> 00:01:50,840 the value of a variable or a list of variables. 48 48 00:01:50,840 --> 00:01:53,440 Using a get request, one or more variable values 49 49 00:01:53,440 --> 00:01:56,380 can be requested from the agent by the manager. 50 50 00:01:56,380 --> 00:01:59,140 Now, a trap message is a little bit different though, 51 51 00:01:59,140 --> 00:02:01,400 because these are going to be sent asynchronously, 52 52 00:02:01,400 --> 00:02:04,430 as notifications from the agent to the manager. 53 53 00:02:04,430 --> 00:02:06,462 In the case of trap messages, the agent is going to send 54 54 00:02:06,462 --> 00:02:08,780 the information without first being requested 55 55 00:02:08,780 --> 00:02:10,010 from the manager. 56 56 00:02:10,010 --> 00:02:12,620 This allows the agents to notify the management station 57 57 00:02:12,620 --> 00:02:14,430 of a significant events that are occurring 58 58 00:02:14,430 --> 00:02:15,920 in near real time. 59 59 00:02:15,920 --> 00:02:18,440 In general, traps are going to be used to provide events 60 60 00:02:18,440 --> 00:02:21,570 or alarm notifications to the manager from the agent. 61 61 00:02:21,570 --> 00:02:23,870 Since trap messages are unsolicited information 62 62 00:02:23,870 --> 00:02:25,470 being sent from the manage devices 63 63 00:02:25,470 --> 00:02:27,770 back to your network manager, you might be wondering 64 64 00:02:27,770 --> 00:02:29,410 what kind of information is contained 65 65 00:02:29,410 --> 00:02:31,500 within an SNMP trap message? 66 66 00:02:31,500 --> 00:02:33,710 Well, this can include lots of things. 67 67 00:02:33,710 --> 00:02:36,130 Things like uptime, configuration changes, 68 68 00:02:36,130 --> 00:02:38,570 unexpected downtime of a particular network link, 69 69 00:02:38,570 --> 00:02:40,820 or other essential information on your network, 70 70 00:02:40,820 --> 00:02:43,100 that's used in the monitoring and detection of unforeseen 71 71 00:02:43,100 --> 00:02:45,130 events and network outages. 72 72 00:02:45,130 --> 00:02:47,530 Now there are two different methods used to encode the data 73 73 00:02:47,530 --> 00:02:50,080 inside your SNMP trap messages. 74 74 00:02:50,080 --> 00:02:53,670 These can be sent as granular traps or verbose traps. 75 75 00:02:53,670 --> 00:02:56,670 With a granular trap, each SNMP trap message 76 76 00:02:56,670 --> 00:02:59,880 is sent with a unique object identifier or OID. 77 77 00:02:59,880 --> 00:03:02,790 This number allows the SNMP manager to distinguish each 78 78 00:03:02,790 --> 00:03:05,360 message as a unique message being received. 79 79 00:03:05,360 --> 00:03:08,250 Now, an OID is a unique object identifier, 80 80 00:03:08,250 --> 00:03:10,290 which identifies a variable that can be read 81 81 00:03:10,290 --> 00:03:12,430 or set via SNMP. 82 82 00:03:12,430 --> 00:03:14,710 As these individual OIDs are received, 83 83 00:03:14,710 --> 00:03:16,590 they're going to be consolidated and stored inside 84 84 00:03:16,590 --> 00:03:19,160 a translation file known as the MIB 85 85 00:03:19,160 --> 00:03:21,510 or management information base. 86 86 00:03:21,510 --> 00:03:23,900 The MIB is used to describe the structure of the management 87 87 00:03:23,900 --> 00:03:27,360 data of a device subsystem using a hierarchal namespace 88 88 00:03:27,360 --> 00:03:29,920 containing object identifier that OID, 89 89 00:03:29,920 --> 00:03:31,520 as well as other information. 90 90 00:03:31,520 --> 00:03:34,790 Since the MIB contains all the details about the OID, 91 91 00:03:34,790 --> 00:03:37,630 this now allows the SNMP trap messages to send 92 92 00:03:37,630 --> 00:03:41,300 just the changes for particular OID and not the entire list 93 93 00:03:41,300 --> 00:03:43,650 of data known about every variable or measure 94 94 00:03:43,650 --> 00:03:45,440 on a specific device or system. 95 95 00:03:45,440 --> 00:03:48,490 This is bandwidth on the network for us because SNMP traps 96 96 00:03:48,490 --> 00:03:50,790 don't send redundant information over the network. 97 97 00:03:50,790 --> 00:03:54,120 Instead they seek to conserve network resources for us. 98 98 00:03:54,120 --> 00:03:56,040 Now, if we're using verbose traps, 99 99 00:03:56,040 --> 00:03:58,370 the SNMP traps may be configured to contain 100 100 00:03:58,370 --> 00:04:00,660 all the information about a given alert or event 101 101 00:04:00,660 --> 00:04:01,710 as a payload. 102 102 00:04:01,710 --> 00:04:03,480 Since more data is being sent to the manager 103 103 00:04:03,480 --> 00:04:05,950 from the device, it's going to take up more resources 104 104 00:04:05,950 --> 00:04:08,300 on that server, for it to be able to analyze the data 105 105 00:04:08,300 --> 00:04:09,890 contained within each trap. 106 106 00:04:09,890 --> 00:04:12,490 This takes more resources, and it's going to use up more 107 107 00:04:12,490 --> 00:04:14,650 bandwidth as it goes over our network. 108 108 00:04:14,650 --> 00:04:17,910 Now data in these SNMP traps are going to be sent and stored 109 109 00:04:17,910 --> 00:04:20,030 in a key value pair configuration. 110 110 00:04:20,030 --> 00:04:22,070 This is known as variable binding. 111 111 00:04:22,070 --> 00:04:24,450 For example, I might have a list of variable bindings 112 112 00:04:24,450 --> 00:04:27,810 for particular router, things like site name, PR-Branch, 113 113 00:04:27,810 --> 00:04:30,920 criticality, high, severity, low, 114 114 00:04:30,920 --> 00:04:32,830 alarm description, high temperature, 115 115 00:04:32,830 --> 00:04:35,500 and other pertinent information for a given alarm or event 116 116 00:04:35,500 --> 00:04:36,850 basically, that's going to be reported 117 117 00:04:36,850 --> 00:04:38,830 through one of these trap messages. 118 118 00:04:38,830 --> 00:04:41,340 Now, when you're implementing SNMP in your network, 119 119 00:04:41,340 --> 00:04:43,170 you need to keep in mind that there are three different 120 120 00:04:43,170 --> 00:04:46,390 versions of SNMP, and they're not all created equal. 121 121 00:04:46,390 --> 00:04:49,410 SNMPv1 version 2 and version 3 122 122 00:04:49,410 --> 00:04:51,820 have different varying levels of security. 123 123 00:04:51,820 --> 00:04:53,140 Now, as you can probably guess, 124 124 00:04:53,140 --> 00:04:56,670 SNMPv3 is the newest and it was built as an improved version 125 125 00:04:56,670 --> 00:05:00,340 over version 1 and version 2 making it the most secure. 126 126 00:05:00,340 --> 00:05:03,090 When you're dealing with SNMPv1 and version 2, 127 127 00:05:03,090 --> 00:05:05,960 these versions use a community string to give them access 128 128 00:05:05,960 --> 00:05:08,490 to the devices as their security mechanism. 129 129 00:05:08,490 --> 00:05:11,310 Now, these community string act as a shared secret key, 130 130 00:05:11,310 --> 00:05:13,680 but in SNMPv1 and version 2, 131 131 00:05:13,680 --> 00:05:16,150 it was set and stored in plain text, 132 132 00:05:16,150 --> 00:05:17,870 making it really insecure. 133 133 00:05:17,870 --> 00:05:19,940 Now these default community strings are either 134 134 00:05:19,940 --> 00:05:22,780 public read-only, or private read-write, 135 135 00:05:22,780 --> 00:05:25,840 and the devices are considered a huge security risk when 136 136 00:05:25,840 --> 00:05:27,720 they're using these default community strings 137 137 00:05:27,720 --> 00:05:31,780 in SNMPv1 and v2 because they're vulnerable to attack. 138 138 00:05:31,780 --> 00:05:35,280 So in SNMPv3, there was some added security 139 139 00:05:35,280 --> 00:05:36,910 to overcome this issue. 140 140 00:05:36,910 --> 00:05:39,320 To mitigate the vulnerability with the community strings, 141 141 00:05:39,320 --> 00:05:42,500 SNMPv3 provides three security enhancements, 142 142 00:05:42,500 --> 00:05:44,440 which added integrity, authentication, 143 143 00:05:44,440 --> 00:05:47,340 and confidentiality to the SNMP protocol. 144 144 00:05:47,340 --> 00:05:50,290 So how does SNMP solve all these problems? 145 145 00:05:50,290 --> 00:05:52,940 Well, for integrity, they started hashing the messages 146 146 00:05:52,940 --> 00:05:54,370 before they were being transmitted, 147 147 00:05:54,370 --> 00:05:56,220 to make sure nobody could alter the data 148 148 00:05:56,220 --> 00:05:58,730 as it was being sent from the routers or switches 149 149 00:05:58,730 --> 00:06:00,120 to the management node. 150 150 00:06:00,120 --> 00:06:01,990 For authentication, they started validating 151 151 00:06:01,990 --> 00:06:03,860 the source of the messages, that way you knew 152 152 00:06:03,860 --> 00:06:04,940 where they came from. 153 153 00:06:04,940 --> 00:06:07,020 For confidentiality, they added encryption 154 154 00:06:07,020 --> 00:06:09,820 and they started using DES or the Data Encryption Standard 155 155 00:06:09,820 --> 00:06:12,100 with a 56 bit encryption key to provide 156 156 00:06:12,100 --> 00:06:14,120 confidentiality and privacy. 157 157 00:06:14,120 --> 00:06:16,070 Now, if you know anything about encryption you know 158 158 00:06:16,070 --> 00:06:18,280 that DES is considered a weak algorithm. 159 159 00:06:18,280 --> 00:06:21,280 And so over time it's been replaced by 3DES 160 160 00:06:21,280 --> 00:06:23,870 and now AES, the Advanced Encryption Standard 161 161 00:06:23,870 --> 00:06:26,710 in newer devices that rely on SNMPv3. 162 162 00:06:26,710 --> 00:06:29,210 But you can only use those newer algorithms, 163 163 00:06:29,210 --> 00:06:31,170 if you have a firmware on your device 164 164 00:06:31,170 --> 00:06:32,940 that supports those newer algorithms. 165 165 00:06:32,940 --> 00:06:35,570 If not, you're still going to have to rely on DES. 166 166 00:06:35,570 --> 00:06:38,275 Now another benefit of SNMPv3 is that it groups 167 167 00:06:38,275 --> 00:06:41,180 our SNMP components into different entities 168 168 00:06:41,180 --> 00:06:42,560 to increase security. 169 169 00:06:42,560 --> 00:06:44,770 Each group can then be given different authorizations 170 170 00:06:44,770 --> 00:06:47,360 and access privileges, such as read, write, 171 171 00:06:47,360 --> 00:06:48,980 or read-write access. 172 172 00:06:48,980 --> 00:06:50,840 By allowing us to create groups of smaller 173 173 00:06:50,840 --> 00:06:53,620 and smaller sizes, we can better protect our networks 174 174 00:06:53,620 --> 00:06:56,170 and the SNMP traps that are being sent across them.