SNMP - Complete Configuration
Overview
Highlight supports SNMP v1, v2c, and v3. There are two elements to the commands needed:
Limit access to the Highlight polling agents, by means of access control lists or similar.
Define a community string (v1/v2c), or authentication parameters (v3), which must match those set up in Highlight.
For manufacturer-specific examples, refer to the relevant section below.
Generic SNMP Access
The following configuration steps need to be taken to allow SNMP communication from the server(s) hosting the Highlight pollers. Other IP sources will be blocked from using the SNMP community string configured.
Log onto the router using the management web interface.
Navigate to the Admin menu that allows you to modify the SNMP settings and the IP addresses that are allowed to poll your router.
Depending on your router model, select the appropriate system security menu option and enable SNMP Management.
Set your Get Community (Read only) and Set Community (Read-Write) to a string of your choice. The defaults of
publicandprivatemust be changed.Add in the IP addresses of the Highlight pollers as allowed SNMP sources. This is sometimes called the Manager Host IP (IPv4).
Some router models require you to enable remote management via the internet, so you may need to enable the SNMP Server option in the Internet Access Control section if your router has this option.
Apply and save the configuration. The device may need to be rebooted, depending on the model.
Always check to ensure you can still remotely manage the device; then continue to the next stage in adding the device as a watch in Highlight.
Cisco Basic SNMP Access
The following lines of configuration allow read-only SNMP communication from the server(s) hosting the Highlight polling of the device. Other IP sources will be blocked from using the SNMP community string configured.
SNMP v1/v2c
Where highlightREAD is the configured community string on the device, and 90 is any available access-list number or name.
SNMP v3
Where 90 is any available access-list number or name, and the keys are at least 8 characters in length.
Cisco Performance SNMP Access
In order to utilise the performance visibility elements of Highlight, the device needs to allow write access to the RTTMon MIB — a very small subset of the MIB tree only responsible for building IP SLA tests on the router. The view line limits the WRITE access to the RTTMon MIB and the separate community string (still supported by access-list restrictions) adds another layer of authentication to the WRITE process.
SNMP v1/v2c
Where highlightWRITE is the Read-Write SNMP password, which must not be the same as the password used for Read-Only access; rttview is a view name used to restrict the SNMP read-write access; and 90 is the access-list number or name as used for Basic SNMP access.
SNMP v3
Where rttview is a view name used to restrict the SNMP read-write access; and 90 is the access-list number or name as used for Basic SNMP access.
Additional Configuration
The Precision Delay and MOS tests require a Cisco device as a target with the following configuration. A UDP Echo test between routers also requires this configuration on the target:
Some performance tests will require DNS to be configured on the router. A Cisco router running IOS v15.x requires a license greater than "Base". Licence details are available from Reporting Inventory.
Cisco Application Level SNMP Access
There are two ways to enable application visibility in Highlight.
The first is via the NBAR application in Cisco routers — details can be found on the NBAR configuration page.
Alternatively, application visibility can be enabled using Flow — details can be found on the Flow configuration page.
Both NBAR and Flow are needed to enable AppVis™.
Cisco Quality of Service SNMP Access
Highlight is capable of showing traffic levels and health of individual classes of service.
The Basic SNMP Access defined above will show traffic for any outbound classes.
Because ISPs normally only set outbound QoS, to see a full 2-direction view of traffic it is necessary to add an inbound policy which, although not setting any prioritisation or queueing, does create SNMP counters for each class. The configuration is fully dependent on the configuration of the outbound QoS policy — read Class of Service for further details.
Huawei Configuration Example
Whether using SNMP v2c or v3, restrict SNMP access with an access control list as follows:
Where 2090 is any available access-list number or name.
SNMP v2c
Additional code to set up SNMP access:
Where highlightREAD is the configured community string on the device, and 2090 is the configured access list.
SNMP v3
Additional code to set up SNMP access:
Where 2090 is the configured access list.
Juniper Configuration Example
SNMP v2c
SNMP v3
The basic v3 config for a Juniper SRX is shown below. Commands may differ per version and other platforms. Replace values in brackets with your own credentials.
OneAccess Configuration Example
The following example configuration for a OneAccess device allows for SNMP v2c read-only access restricted to two specific poller IP addresses:
Last updated
Was this helpful?