The Simple Network Management Protocol
or SNMP.
In this lesson,
we're going to discuss the Simple Network Management Protocol.
SNMP is an internet protocol
for collecting and organizing information
about managed devices on IP networks,
and for modifying that information
to change the device's behavior.
When we talk about managed devices,
we're referring to any device that can communicate
with an SNMP manager,
known as the management information base, or MIB.
Now, this includes things like routers
and switches and firewalls, and printers and servers
and even your end user client devices.
SNMP can be used to send and receive data
from these managed devices back
to a centralized network management station.
When you're configuring your SNMP architecture,
you have to have a manager, and then you have agents.
Now, the SNMP manager could be any machine on your network
that's running the SNMP protocol to collect
and process information from the devices on your LAN or WAN.
Normally though, you're going to set this up on a server,
especially in a large enterprise environment.
Now, the agents are different network devices
that are sending information about themselves
over the network back to that manager.
Usually, an agent is just running a background service
to collect the data and send it back
to the manager at regular intervals
or when they're requested to do so by that manager.
Now, the SNMP manager is essentially a master node
and it's going to be able to send and receive these messages
to those agents using three different message types.
These are set, get, and trap messages.
Now, the set and get messages are pretty straightforward.
The set request is a manager to an agent request
and it's going to change the value
of a variable or a list of variables.
When this request is received by the agent,
it's going to update its variables to the latest status
and then provide a response to the manager
with a list of all the new values for that variable.
A get request is a manager to agent request
to retrieve the value of a variable
or a list of variables.
Using a get request,
one or more variable values can be requested
from the agent by the manager.
Now, a trap message is a little bit different though
because these are going to be sent asynchronously
as notifications from the agent to the manager.
In the case of trap messages,
the agent is going to send the information
without first being requested from the manager.
This allows the agents to notify the management station
of any significant events that are occurring
in near real time.
In general, traps are going to be used to provide events
or alarm notifications to the manager from the agent.
Since trap messages or unsolicited information being sent
from the managed devices back to your network manager,
you might be wondering what kind
of information is contained within an SNMP trap message.
Well, this can include lots of things.
Things like uptime, configuration changes,
unexpected downtime of a particular network link
or other essential information
on your network that's used in the monitoring
and detection of unforeseen events and network outages.
Now, there are two different methods used to encode the data
inside your SNMP trap messages.
These can be sent as granular traps or verbose traps.
With a granular trap, each SNMP trap message is sent
with a unique object identifier or OID.
This number allows the SNMP manager
to distinguish each message
as a unique message being received.
Now, an OID is a unique object identifier,
which identifies a variable that can be read
or set via SNMP.
As these individual OIDs are received,
they're going to be consolidated and stored
inside a translation file known as the MIB
or management information base.
The MIB is used to describe the structure
of the management data of a device subsystem
using a hierarchal namespace
containing the object identifier, that OID,
as well as other information.
Since the MIB contains all the details about the OID,
this now allows the SNMP trap messages
to send just the changes for a particular OID
and not the entire list
of data known about every variable or measure
on a specific device or system.
This saves bandwidth on the network for us
because SNMP traps don't send redundant information
over the network.
Instead, they seek to conserve network resources for us.
Now, if we're using verbose traps,
the SNMP traps may be configured
to contain all the information about a given alert
or event as a payload.
Since more data is being sent to the manager
from the device, it's going to take up more resources
on that server for it to be able
to analyze the data contained within each trap.
This takes more resources
and it's going to use up more bandwidth
as it goes over our network.
Now, data in these SNMP traps are going to be sent and stored
in a key-value pair configuration.
This is known as variable binding.
For example, I might have a list of variable bindings
for a particular router,
things like SiteName: PR-Branch,
Criticality: High, Severity: Low,
Alarm Description: High temperature,
and other pertinent information for a given alarm or event
basically that's going to be reported
through one of these trap messages.
Now, when you're implementing SNMP in your network,
you need to keep in mind
that there are three different versions of SNMP
and they're not all created equal.
SNMP version one, version two
and version three have different
and varying levels of security.
Now, as you can probably guess,
SNMP version three is the newest
and it was built as an improved version
over version one and version two, making it the most secure.
When you're dealing with SNMP version one and version two,
these versions use a community string to give them access
to the devices as their security mechanism.
Now, these community strings act as a shared secret key
but in SNMP version one and version two, it was set
and stored in plain text making it really insecure.
Now, these default community strings
are either public read-only or private read-write
and the devices are considered a huge security risk
when they're using these default community strings
in SNMP v1 and v2 because they're vulnerable to attack.
So in SNMP version three,
there was some added security to overcome this issue.
To mitigate the vulnerability with the community strings,
SNMP version 3 provides three security enhancements,
which added integrity, authentication, and confidentiality
to the SNMP protocol.
So how does SNMP solve all these problems?
Well, for integrity, they started hashing the messages
before they were being transmitted to make sure nobody
could alter the data as was being sent from the routers
or switches to the management node.
For authentication, they started validating the source
of the messages.
That way you knew where they came from.
For confidentiality, they added encryption
and they started using DES, or the Data Encryption Standard,
with a 56-bit encryption key
to provide confidentiality and privacy.
Now, if you know anything about encryption,
you know that DES is considered a weak algorithm
and so over time, it's been replaced by 3DES
and now AES, the Advanced Encryption Standard
in newer devices that rely on SNMP v3
but you can only use those newer algorithms
if you have a firmware on your device
that supports those newer algorithms.
If not, you're still going to have to rely on DES.
Now, another benefit of SNMP version three
is that it groups our SNMP components
into different entities to increase security.
Each group can then be given different authorizations
and access privileges, such as read, write
or read-write access.
By allowing us to create groups of smaller
and smaller sizes, we can better protect our networks
and the SNMP traps that are being sent across them.