How do I monitor a Scanner Appliance with SNMP?
This article describes how to enable Simple Network Management Protocol (SNMP) on a Scanner Appliance and how to connect it to your network monitoring system (NMS), so you can track the appliance’s health.
SNMP is turned off by default. You enable it in the Appliance console UI. Access is read-only, and the Scanner Appliance only answers polls from managers you allow. Only SNMPv3 with authentication and encryption is supported.
What do I need before I begin?
Monitoring system requirements
Your NMS must support SNMPv3 with SHA-256 authentication and AES-128 encryption. Tools that only offer MD5 or SHA-1 authentication will not work.
Firewall requirements
Allow UDP port 161 from your NMS pollers to the Scanner Appliance in every firewall between them.
Read more about general firewall settings here:
What are the firewall settings for a Scanner Appliance?
Limitations
- The Scanner Appliance does not send SNMP traps. Your NMS must poll it.
- Only IPv4 is supported.
- SNMPv1, SNMPv2c and community strings are not supported.
What data can my monitoring system read?
The Scanner Appliance uses standard Management Information Bases (MIBs). Common “Linux via SNMP” or “Net-SNMP” templates in your NMS work without extra MIB files.
| Area: | Data: |
|---|---|
| System | Description, uptime and name (the appliance hostname) |
| Interfaces | Status, traffic and error counters, including 64-bit counters |
| CPU | Per-core load, load averages and raw CPU counters |
| Memory | Total and available memory, swap |
| Storage | Filesystem usage, root disk usage in percent and disk I/O |
Some data is hidden on purpose
The process list, installed packages, ARP table, network connections and SNMP build information are not available over SNMP. This keeps the scanner’s view of your network from being exposed.
How do I enable SNMP on the Scanner Appliance?
- Open the Appliance console UI on your virtualization platform.
- Select Configuration.
- Select Snmp.
- Select Enable.
- Enter the following values:
- Username: 1-32 characters. Use letters, digits, dot (.), underscore (_) or hyphen (-).
- Authentication passphrase: 8-64 printable ASCII characters.
- Encryption passphrase: 8-64 printable ASCII characters.
- Allowed managers: The IPv4 addresses or networks of your NMS pollers, separated by spaces or commas, e.g., “10.0.0.5 10.1.0.0/24”.
- Press F11 to save.
- Done!
When you save, the Scanner Appliance creates one SNMPv3 user, opens UDP port 161 for the allowed managers only, and starts the SNMP service. Queries from any other address are dropped. Your settings are kept after reboots and appliance updates.
Save your credentials
Write down the username and both passphrases. You need them when you configure your NMS.
How do I configure my monitoring system?
Add the Scanner Appliance as a device in your NMS with these settings:
| Setting: | Value: |
|---|---|
| SNMP version | 3 |
| Security level | authPriv |
| Username | The username you set on the Scanner Appliance |
| Authentication protocol | SHA-256 |
| Authentication passphrase | The authentication passphrase you set on the Scanner Appliance |
| Privacy protocol | AES (AES-128) |
| Privacy passphrase | The encryption passphrase you set on the Scanner Appliance |
| Target | The IP address of the Scanner Appliance |
| Port | UDP 161 |
| Context | Leave empty |
| Engine ID | Leave empty. Your NMS discovers it automatically. |
Different names for the same setting
Some monitoring tools call the privacy passphrase “privacy password”, “encryption key” or “crypto password”.
How do I change allowed managers or disable SNMP?
Change the allowed managers
- In the Appliance console UI, select Configuration > Snmp.
- Update Allowed managers.
- Leave both passphrase fields empty to keep the current passphrases.
- Press F11 to save.
- Done!
Disable SNMP
- In the Appliance console UI, select Configuration > Snmp.
- Select Disable.
- Press F11 to save.
- Done!
Note
When you disable SNMP, the Scanner Appliance removes the SNMP user and the firewall rules, and stops the SNMP service.
How does SNMP behave on the Scanner Appliance?
- Passphrases are never stored in plain text. The SNMP service converts them into keys when it starts.
- SHA-1, MD5 and DES are rejected.
- Per-core CPU load appears about one minute after SNMP is enabled.
- The location and contact values always show “Unknown” and “root”. These values cannot be changed.
- The Scanner Appliance cannot query itself over SNMP. Only the allowed managers get a response.
What if my monitoring system cannot connect?
Check the following:
- Your NMS supports SHA-256 authentication.
- The IP address of your NMS is listed in Allowed managers.
- UDP port 161 is open between your NMS and the Scanner Appliance.