Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
| tech-notes:snmp [2021/01/08 09:58] – gerardorourke | tech-notes:snmp [2021/01/08 13:30] (current) – [SNMP Trace] gerardorourke | ||
|---|---|---|---|
| Line 6: | Line 6: | ||
| ==== Cisco Config ==== | ==== Cisco Config ==== | ||
| + | |||
| + | Reference: https:// | ||
| + | |||
| < | < | ||
| snmp-server view MYVIEW iso included | snmp-server view MYVIEW iso included | ||
| Line 25: | Line 28: | ||
| Group-name: myGroupName_RO | Group-name: myGroupName_RO | ||
| </ | </ | ||
| + | |||
| + | Note: SNMP passwords are localized using the SNMP engine ID of the authoritative SNMP engine. For SNMP notifications such as inform requests, the authoritative SNMP agent is the remote agent. You must configure the SNMP engine ID of the remote agent in the SNMP database before you can send proxy requests or inform requests to it. | ||
| + | |||
| + | This is the case for all SNMP v3 devices -i.e. part of the standard. | ||
| + | |||
| + | Reference: https:// | ||
| + | ==== SNMP Trace ==== | ||
| + | {{: | ||
| + | |||
| + | *Not all traffic is encrypted. | ||
| + | *You can see the engineID and the username in clear text even in the encrypted packets. | ||
| + | *The client requires the engine ID to encrypt the password | ||
| + | |||
| + | |||
| + | |||
| + | Packet 1: It asks the router for via SNMP for its engine ID (Unqiue for every router) – needed to encrypted the password. | ||
| + | |||
| + | Packet 2: Router replies with EngineID | ||
| + | |||
| + | Packet 3: we send an encrypted PDU (note username and engineID are in header and are not encrypted) | ||
| + | |||
| + | Packet 4: we get a report back in clear text of “The total number of packets received by the SNMP engine which were dropped because they appeared outside of the authoritative SNMP engine' | ||
| + | This is because have not set the EngineTime in our requests (as we don’t know what it should be set to!) | ||
| + | The response also include the EngineTime, i.e. contains: | ||
| + | *msgAutoritativeEngineID | ||
| + | *msgAutoritativeEngineBoots | ||
| + | *msgAutoritativeEngineTime | ||
| + | |||
| + | |||
| + | Packet 5: we sent the request again (encrypted) but now also with the correct EngineBoot and EngineTime values. | ||
| + | |||
| + | Packet 6: We get a successful response (encrypted) | ||