Differences

This shows you the differences between two versions of the page.

--- tech-notes:snmp [2021/01/08 09:59] – [Cisco Config] gerardorourke
+++ tech-notes:snmp [2021/01/08 13:30] (current) – [SNMP Trace] gerardorourke
@@ Line 6: / Line 6: @@
 ==== Cisco Config ====
+Reference: https://en.wikipedia.org/wiki/Simple_Network_Management_Protocol
 <code>
 snmp-server view MYVIEW iso included
@@ Line 32: / Line 35: @@
 Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/snmp/configuration/xe-3se/3850/snmp-xe-3se-3850-book/nm-snmp-snmpv3.html
+==== SNMP Trace ====
+{{:tech-notes:snmp-v3.png?400|}}
+  *Not all traffic is encrypted.
+  *You can see the engineID and the username in clear text even in the encrypted packets.
+  *The client requires the engine ID to encrypt the password
+Packet 1: It asks the router for via SNMP for its engine ID (Unqiue for every router) – needed to encrypted the password.
+Packet 2: Router replies with EngineID
+Packet 3: we send an encrypted PDU (note username and engineID are in header and are not encrypted)
+Packet 4: we get a report back in clear text of “The total number of packets received by the SNMP engine which were dropped because they appeared outside of the authoritative SNMP engine's window.” – reference: https://oidref.com/1.3.6.1.6.3.15.1.1.2
+This is because have not set the EngineTime in our requests (as we don’t know what it should be set to!)
+The response also include the EngineTime, i.e. contains:
+  *msgAutoritativeEngineID
+  *msgAutoritativeEngineBoots
+  *msgAutoritativeEngineTime
+Packet 5: we sent the request again (encrypted) but now also with the correct EngineBoot and EngineTime values.
+Packet 6: We get a successful response (encrypted)