-: The Simple Network Management Protocol or SNMP. 2 2
In this lesson we're going to discuss 3 3
the Simple Network Management Protocol. 4 4
SNMP is an internet protocol 5 5
for collecting and organizing information 6 6
about managed devices on IP networks, 7 7
and for modifying that information 8 8
to change the devices behavior. 9 9
When we talk about managed devices 10 10
we're referring to any device that can communicate 11 11
with an SNMP manager 12 12
known as the management information base or MIB. 13 13
Now this includes things like routers and switches 14 14
and firewalls and printers and servers 15 15
and even your end user client devices. 16 16
SNMP can be used to send and receive data 17 17
from these managed devices 18 18
back to a centralized network management station. 19 19
When you're configuring your SNMP architecture, 20 20
you have to have a manager and then you have agents. 21 21
Now the SNMP manager could be any machine on your network 22 22
that's running the SNMP protocol 23 23
to collect and process information 24 24
from the devices on your LAN or WAN. 25 25
Normally though, you're going to set this up on a server, 26 26
especially in a large enterprise environment. 27 27
Now, the agents are different network devices, 28 28
they're sending information about themselves 29 29
over the network, back to that manager. 30 30
Usually an agent is just running a background service 31 31
to collect the data and send it back to the manager 32 32
at regular intervals, or when they're requested to do so 33 33
by that manager. 34 34
Now the SNMP manager is essentially a master node, 35 35
and it's going to be able to send and receive these messages 36 36
to those agents using three different message types. 37 37
These are set, get, and trap messages. 38 38
Now the set and get messages are pretty straightforward. 39 39
The set request is a manager to an agent request, 40 40
and it's going to change the value of a variable 41 41
or a list of variables. 42 42
When this request is received by the agent, 43 43
it's going to update its variables to the latest status, 44 44
and then provide a response to the manager 45 45
with a list of all the new values for that variable. 46 46
A get request is a manager to agent requests to retrieve 47 47
the value of a variable or a list of variables. 48 48
Using a get request, one or more variable values 49 49
can be requested from the agent by the manager. 50 50
Now, a trap message is a little bit different though, 51 51
because these are going to be sent asynchronously, 52 52
as notifications from the agent to the manager. 53 53
In the case of trap messages, the agent is going to send 54 54
the information without first being requested 55 55
from the manager. 56 56
This allows the agents to notify the management station 57 57
of a significant events that are occurring 58 58
in near real time. 59 59
In general, traps are going to be used to provide events 60 60
or alarm notifications to the manager from the agent. 61 61
Since trap messages are unsolicited information 62 62
being sent from the manage devices 63 63
back to your network manager, you might be wondering 64 64
what kind of information is contained 65 65
within an SNMP trap message? 66 66
Well, this can include lots of things. 67 67
Things like uptime, configuration changes, 68 68
unexpected downtime of a particular network link, 69 69
or other essential information on your network, 70 70
that's used in the monitoring and detection of unforeseen 71 71
events and network outages. 72 72
Now there are two different methods used to encode the data 73 73
inside your SNMP trap messages. 74 74
These can be sent as granular traps or verbose traps. 75 75
With a granular trap, each SNMP trap message 76 76
is sent with a unique object identifier or OID. 77 77
This number allows the SNMP manager to distinguish each 78 78
message as a unique message being received. 79 79
Now, an OID is a unique object identifier, 80 80
which identifies a variable that can be read 81 81
or set via SNMP. 82 82
As these individual OIDs are received, 83 83
they're going to be consolidated and stored inside 84 84
a translation file known as the MIB 85 85
or management information base. 86 86
The MIB is used to describe the structure of the management 87 87
data of a device subsystem using a hierarchal namespace 88 88
containing object identifier that OID, 89 89
as well as other information. 90 90
Since the MIB contains all the details about the OID, 91 91
this now allows the SNMP trap messages to send 92 92
just the changes for particular OID and not the entire list 93 93
of data known about every variable or measure 94 94
on a specific device or system. 95 95
This is bandwidth on the network for us because SNMP traps 96 96
don't send redundant information over the network. 97 97
Instead they seek to conserve network resources for us. 98 98
Now, if we're using verbose traps, 99 99
the SNMP traps may be configured to contain 100 100
all the information about a given alert or event 101 101
as a payload. 102 102
Since more data is being sent to the manager 103 103
from the device, it's going to take up more resources 104 104
on that server, for it to be able to analyze the data 105 105
contained within each trap. 106 106
This takes more resources, and it's going to use up more 107 107
bandwidth as it goes over our network. 108 108
Now data in these SNMP traps are going to be sent and stored 109 109
in a key value pair configuration. 110 110
This is known as variable binding. 111 111
For example, I might have a list of variable bindings 112 112
for particular router, things like site name, PR-Branch, 113 113
criticality, high, severity, low, 114 114
alarm description, high temperature, 115 115
and other pertinent information for a given alarm or event 116 116
basically, that's going to be reported 117 117
through one of these trap messages. 118 118
Now, when you're implementing SNMP in your network, 119 119
you need to keep in mind that there are three different 120 120
versions of SNMP, and they're not all created equal. 121 121
SNMPv1 version 2 and version 3 122 122
have different varying levels of security. 123 123
Now, as you can probably guess, 124 124
SNMPv3 is the newest and it was built as an improved version 125 125
over version 1 and version 2 making it the most secure. 126 126
When you're dealing with SNMPv1 and version 2, 127 127
these versions use a community string to give them access 128 128
to the devices as their security mechanism. 129 129
Now, these community string act as a shared secret key, 130 130
but in SNMPv1 and version 2, 131 131
it was set and stored in plain text, 132 132
making it really insecure. 133 133
Now these default community strings are either 134 134
public read-only, or private read-write, 135 135
and the devices are considered a huge security risk when 136 136
they're using these default community strings 137 137
in SNMPv1 and v2 because they're vulnerable to attack. 138 138
So in SNMPv3, there was some added security 139 139
to overcome this issue. 140 140
To mitigate the vulnerability with the community strings, 141 141
SNMPv3 provides three security enhancements, 142 142
which added integrity, authentication, 143 143
and confidentiality to the SNMP protocol. 144 144
So how does SNMP solve all these problems? 145 145
Well, for integrity, they started hashing the messages 146 146
before they were being transmitted, 147 147
to make sure nobody could alter the data 148 148
as it was being sent from the routers or switches 149 149
to the management node. 150 150
For authentication, they started validating 151 151
the source of the messages, that way you knew 152 152
where they came from. 153 153
For confidentiality, they added encryption 154 154
and they started using DES or the Data Encryption Standard 155 155
with a 56 bit encryption key to provide 156 156
confidentiality and privacy. 157 157
Now, if you know anything about encryption you know 158 158
that DES is considered a weak algorithm. 159 159
And so over time it's been replaced by 3DES 160 160
and now AES, the Advanced Encryption Standard 161 161
in newer devices that rely on SNMPv3. 162 162
But you can only use those newer algorithms, 163 163
if you have a firmware on your device 164 164
that supports those newer algorithms. 165 165
If not, you're still going to have to rely on DES. 166 166
Now another benefit of SNMPv3 is that it groups 167 167
our SNMP components into different entities 168 168
to increase security. 169 169
Each group can then be given different authorizations 170 170
and access privileges, such as read, write, 171 171
or read-write access. 172 172
By allowing us to create groups of smaller 173 173
and smaller sizes, we can better protect our networks 174 174
and the SNMP traps that are being sent across them.