1 00:00:00,210 --> 00:00:02,130 The Simple Network Management Protocol 2 00:00:02,130 --> 00:00:03,810 or SNMP. 3 00:00:03,810 --> 00:00:04,710 In this lesson, 4 00:00:04,710 --> 00:00:07,980 we're going to discuss the Simple Network Management Protocol. 5 00:00:07,980 --> 00:00:09,720 SNMP is an internet protocol 6 00:00:09,720 --> 00:00:11,700 for collecting and organizing information 7 00:00:11,700 --> 00:00:14,130 about managed devices on IP networks, 8 00:00:14,130 --> 00:00:15,780 and for modifying that information 9 00:00:15,780 --> 00:00:17,820 to change the device's behavior. 10 00:00:17,820 --> 00:00:19,500 When we talk about managed devices, 11 00:00:19,500 --> 00:00:21,600 we're referring to any device that can communicate 12 00:00:21,600 --> 00:00:23,310 with an SNMP manager, 13 00:00:23,310 --> 00:00:26,133 known as the management information base, or MIB. 14 00:00:27,090 --> 00:00:28,860 Now, this includes things like routers 15 00:00:28,860 --> 00:00:31,890 and switches and firewalls, and printers and servers 16 00:00:31,890 --> 00:00:34,410 and even your end user client devices. 17 00:00:34,410 --> 00:00:36,660 SNMP can be used to send and receive data 18 00:00:36,660 --> 00:00:38,310 from these managed devices back 19 00:00:38,310 --> 00:00:40,770 to a centralized network management station. 20 00:00:40,770 --> 00:00:43,110 When you're configuring your SNMP architecture, 21 00:00:43,110 --> 00:00:45,930 you have to have a manager, and then you have agents. 22 00:00:45,930 --> 00:00:48,720 Now, the SNMP manager could be any machine on your network 23 00:00:48,720 --> 00:00:51,060 that's running the SNMP protocol to collect 24 00:00:51,060 --> 00:00:54,510 and process information from the devices on your LAN or WAN. 25 00:00:54,510 --> 00:00:57,150 Normally though, you're going to set this up on a server, 26 00:00:57,150 --> 00:00:59,820 especially in a large enterprise environment. 27 00:00:59,820 --> 00:01:01,920 Now, the agents are different network devices 28 00:01:01,920 --> 00:01:03,900 that are sending information about themselves 29 00:01:03,900 --> 00:01:06,360 over the network back to that manager. 30 00:01:06,360 --> 00:01:08,970 Usually, an agent is just running a background service 31 00:01:08,970 --> 00:01:10,530 to collect the data and send it back 32 00:01:10,530 --> 00:01:12,120 to the manager at regular intervals 33 00:01:12,120 --> 00:01:15,570 or when they're requested to do so by that manager. 34 00:01:15,570 --> 00:01:18,540 Now, the SNMP manager is essentially a master node 35 00:01:18,540 --> 00:01:20,850 and it's going to be able to send and receive these messages 36 00:01:20,850 --> 00:01:23,760 to those agents using three different message types. 37 00:01:23,760 --> 00:01:26,940 These are set, get, and trap messages. 38 00:01:26,940 --> 00:01:30,000 Now, the set and get messages are pretty straightforward. 39 00:01:30,000 --> 00:01:32,730 The set request is a manager to an agent request 40 00:01:32,730 --> 00:01:33,960 and it's going to change the value 41 00:01:33,960 --> 00:01:36,480 of a variable or a list of variables. 42 00:01:36,480 --> 00:01:38,370 When this request is received by the agent, 43 00:01:38,370 --> 00:01:40,650 it's going to update its variables to the latest status 44 00:01:40,650 --> 00:01:42,720 and then provide a response to the manager 45 00:01:42,720 --> 00:01:45,540 with a list of all the new values for that variable. 46 00:01:45,540 --> 00:01:47,760 A get request is a manager to agent request 47 00:01:47,760 --> 00:01:49,410 to retrieve the value of a variable 48 00:01:49,410 --> 00:01:50,850 or a list of variables. 49 00:01:50,850 --> 00:01:52,170 Using a get request, 50 00:01:52,170 --> 00:01:54,240 one or more variable values can be requested 51 00:01:54,240 --> 00:01:56,370 from the agent by the manager. 52 00:01:56,370 --> 00:01:59,160 Now, a trap message is a little bit different though 53 00:01:59,160 --> 00:02:01,380 because these are going to be sent asynchronously 54 00:02:01,380 --> 00:02:04,440 as notifications from the agent to the manager. 55 00:02:04,440 --> 00:02:05,970 In the case of trap messages, 56 00:02:05,970 --> 00:02:07,380 the agent is going to send the information 57 00:02:07,380 --> 00:02:10,020 without first being requested from the manager. 58 00:02:10,020 --> 00:02:12,630 This allows the agents to notify the management station 59 00:02:12,630 --> 00:02:14,430 of any significant events that are occurring 60 00:02:14,430 --> 00:02:15,930 in near real time. 61 00:02:15,930 --> 00:02:18,420 In general, traps are going to be used to provide events 62 00:02:18,420 --> 00:02:21,600 or alarm notifications to the manager from the agent. 63 00:02:21,600 --> 00:02:24,300 Since trap messages or unsolicited information being sent 64 00:02:24,300 --> 00:02:26,850 from the managed devices back to your network manager, 65 00:02:26,850 --> 00:02:28,230 you might be wondering what kind 66 00:02:28,230 --> 00:02:31,500 of information is contained within an SNMP trap message. 67 00:02:31,500 --> 00:02:33,690 Well, this can include lots of things. 68 00:02:33,690 --> 00:02:36,120 Things like uptime, configuration changes, 69 00:02:36,120 --> 00:02:38,550 unexpected downtime of a particular network link 70 00:02:38,550 --> 00:02:39,900 or other essential information 71 00:02:39,900 --> 00:02:41,880 on your network that's used in the monitoring 72 00:02:41,880 --> 00:02:45,120 and detection of unforeseen events and network outages. 73 00:02:45,120 --> 00:02:47,550 Now, there are two different methods used to encode the data 74 00:02:47,550 --> 00:02:50,100 inside your SNMP trap messages. 75 00:02:50,100 --> 00:02:53,670 These can be sent as granular traps or verbose traps. 76 00:02:53,670 --> 00:02:57,000 With a granular trap, each SNMP trap message is sent 77 00:02:57,000 --> 00:02:59,880 with a unique object identifier or OID. 78 00:02:59,880 --> 00:03:01,950 This number allows the SNMP manager 79 00:03:01,950 --> 00:03:03,240 to distinguish each message 80 00:03:03,240 --> 00:03:05,370 as a unique message being received. 81 00:03:05,370 --> 00:03:08,250 Now, an OID is a unique object identifier, 82 00:03:08,250 --> 00:03:10,290 which identifies a variable that can be read 83 00:03:10,290 --> 00:03:12,450 or set via SNMP. 84 00:03:12,450 --> 00:03:14,730 As these individual OIDs are received, 85 00:03:14,730 --> 00:03:16,320 they're going to be consolidated and stored 86 00:03:16,320 --> 00:03:19,410 inside a translation file known as the MIB 87 00:03:19,410 --> 00:03:21,540 or management information base. 88 00:03:21,540 --> 00:03:23,310 The MIB is used to describe the structure 89 00:03:23,310 --> 00:03:25,800 of the management data of a device subsystem 90 00:03:25,800 --> 00:03:27,390 using a hierarchal namespace 91 00:03:27,390 --> 00:03:29,940 containing the object identifier, that OID, 92 00:03:29,940 --> 00:03:31,530 as well as other information. 93 00:03:31,530 --> 00:03:34,800 Since the MIB contains all the details about the OID, 94 00:03:34,800 --> 00:03:37,170 this now allows the SNMP trap messages 95 00:03:37,170 --> 00:03:40,140 to send just the changes for a particular OID 96 00:03:40,140 --> 00:03:41,280 and not the entire list 97 00:03:41,280 --> 00:03:43,620 of data known about every variable or measure 98 00:03:43,620 --> 00:03:45,450 on a specific device or system. 99 00:03:45,450 --> 00:03:47,220 This saves bandwidth on the network for us 100 00:03:47,220 --> 00:03:49,860 because SNMP traps don't send redundant information 101 00:03:49,860 --> 00:03:50,790 over the network. 102 00:03:50,790 --> 00:03:54,120 Instead, they seek to conserve network resources for us. 103 00:03:54,120 --> 00:03:56,040 Now, if we're using verbose traps, 104 00:03:56,040 --> 00:03:57,900 the SNMP traps may be configured 105 00:03:57,900 --> 00:04:00,240 to contain all the information about a given alert 106 00:04:00,240 --> 00:04:01,710 or event as a payload. 107 00:04:01,710 --> 00:04:03,480 Since more data is being sent to the manager 108 00:04:03,480 --> 00:04:05,940 from the device, it's going to take up more resources 109 00:04:05,940 --> 00:04:07,410 on that server for it to be able 110 00:04:07,410 --> 00:04:09,900 to analyze the data contained within each trap. 111 00:04:09,900 --> 00:04:11,130 This takes more resources 112 00:04:11,130 --> 00:04:12,960 and it's going to use up more bandwidth 113 00:04:12,960 --> 00:04:14,670 as it goes over our network. 114 00:04:14,670 --> 00:04:17,910 Now, data in these SNMP traps are going to be sent and stored 115 00:04:17,910 --> 00:04:20,040 in a key-value pair configuration. 116 00:04:20,040 --> 00:04:22,110 This is known as variable binding. 117 00:04:22,110 --> 00:04:24,420 For example, I might have a list of variable bindings 118 00:04:24,420 --> 00:04:25,560 for a particular router, 119 00:04:25,560 --> 00:04:27,840 things like SiteName: PR-Branch, 120 00:04:27,840 --> 00:04:30,930 Criticality: High, Severity: Low, 121 00:04:30,930 --> 00:04:32,820 Alarm Description: High temperature, 122 00:04:32,820 --> 00:04:35,520 and other pertinent information for a given alarm or event 123 00:04:35,520 --> 00:04:36,870 basically that's going to be reported 124 00:04:36,870 --> 00:04:38,820 through one of these trap messages. 125 00:04:38,820 --> 00:04:41,340 Now, when you're implementing SNMP in your network, 126 00:04:41,340 --> 00:04:42,210 you need to keep in mind 127 00:04:42,210 --> 00:04:44,670 that there are three different versions of SNMP 128 00:04:44,670 --> 00:04:46,380 and they're not all created equal. 129 00:04:46,380 --> 00:04:48,360 SNMP version one, version two 130 00:04:48,360 --> 00:04:50,010 and version three have different 131 00:04:50,010 --> 00:04:51,840 and varying levels of security. 132 00:04:51,840 --> 00:04:53,130 Now, as you can probably guess, 133 00:04:53,130 --> 00:04:55,200 SNMP version three is the newest 134 00:04:55,200 --> 00:04:56,670 and it was built as an improved version 135 00:04:56,670 --> 00:05:00,330 over version one and version two, making it the most secure. 136 00:05:00,330 --> 00:05:03,090 When you're dealing with SNMP version one and version two, 137 00:05:03,090 --> 00:05:05,940 these versions use a community string to give them access 138 00:05:05,940 --> 00:05:08,490 to the devices as their security mechanism. 139 00:05:08,490 --> 00:05:11,310 Now, these community strings act as a shared secret key 140 00:05:11,310 --> 00:05:14,580 but in SNMP version one and version two, it was set 141 00:05:14,580 --> 00:05:17,880 and stored in plain text making it really insecure. 142 00:05:17,880 --> 00:05:19,530 Now, these default community strings 143 00:05:19,530 --> 00:05:22,800 are either public read-only or private read-write 144 00:05:22,800 --> 00:05:25,590 and the devices are considered a huge security risk 145 00:05:25,590 --> 00:05:27,690 when they're using these default community strings 146 00:05:27,690 --> 00:05:31,800 in SNMP v1 and v2 because they're vulnerable to attack. 147 00:05:31,800 --> 00:05:34,080 So in SNMP version three, 148 00:05:34,080 --> 00:05:36,930 there was some added security to overcome this issue. 149 00:05:36,930 --> 00:05:39,330 To mitigate the vulnerability with the community strings, 150 00:05:39,330 --> 00:05:42,480 SNMP version 3 provides three security enhancements, 151 00:05:42,480 --> 00:05:45,660 which added integrity, authentication, and confidentiality 152 00:05:45,660 --> 00:05:47,340 to the SNMP protocol. 153 00:05:47,340 --> 00:05:50,310 So how does SNMP solve all these problems? 154 00:05:50,310 --> 00:05:52,920 Well, for integrity, they started hashing the messages 155 00:05:52,920 --> 00:05:55,110 before they were being transmitted to make sure nobody 156 00:05:55,110 --> 00:05:58,050 could alter the data as was being sent from the routers 157 00:05:58,050 --> 00:06:00,150 or switches to the management node. 158 00:06:00,150 --> 00:06:02,310 For authentication, they started validating the source 159 00:06:02,310 --> 00:06:03,143 of the messages. 160 00:06:03,143 --> 00:06:04,980 That way you knew where they came from. 161 00:06:04,980 --> 00:06:07,020 For confidentiality, they added encryption 162 00:06:07,020 --> 00:06:09,810 and they started using DES, or the Data Encryption Standard, 163 00:06:09,810 --> 00:06:11,700 with a 56-bit encryption key 164 00:06:11,700 --> 00:06:14,130 to provide confidentiality and privacy. 165 00:06:14,130 --> 00:06:15,720 Now, if you know anything about encryption, 166 00:06:15,720 --> 00:06:18,330 you know that DES is considered a weak algorithm 167 00:06:18,330 --> 00:06:21,270 and so over time, it's been replaced by 3DES 168 00:06:21,270 --> 00:06:24,000 and now AES, the Advanced Encryption Standard 169 00:06:24,000 --> 00:06:26,730 in newer devices that rely on SNMP v3 170 00:06:26,730 --> 00:06:29,220 but you can only use those newer algorithms 171 00:06:29,220 --> 00:06:31,200 if you have a firmware on your device 172 00:06:31,200 --> 00:06:32,940 that supports those newer algorithms. 173 00:06:32,940 --> 00:06:35,580 If not, you're still going to have to rely on DES. 174 00:06:35,580 --> 00:06:37,950 Now, another benefit of SNMP version three 175 00:06:37,950 --> 00:06:40,020 is that it groups our SNMP components 176 00:06:40,020 --> 00:06:42,570 into different entities to increase security. 177 00:06:42,570 --> 00:06:44,760 Each group can then be given different authorizations 178 00:06:44,760 --> 00:06:47,370 and access privileges, such as read, write 179 00:06:47,370 --> 00:06:48,990 or read-write access. 180 00:06:48,990 --> 00:06:50,820 By allowing us to create groups of smaller 181 00:06:50,820 --> 00:06:53,610 and smaller sizes, we can better protect our networks 182 00:06:53,610 --> 00:06:56,160 and the SNMP traps that are being sent across them.