RFC を参照しながら SNMP でネットワーク機器をモニタリングする #Cisco

Environment

SNMP Agents
- Ubuntu 18.04
Routers
- Cisco IOS 15.4

Preparation

Install SNMP commands:

$ sudo apt install snmp snmp-mibs-downloader

/etc/snmp/snmp.conf says:

# As the snmp packages come without MIB files due to license reasons, loading
# of MIBs is disabled by default. If you added the MIBs you can reenable
# loading them by commenting out the following line.
mibs :

So,

@@ -1,4 +1,4 @@
 # As the snmp packages come without MIB files due to license reasons, loading
 # of MIBs is disabled by default. If you added the MIBs you can reenable
 # loading them by commenting out the following line.
-mibs :
+#mibs :

Query SNMP Servers

For example, to get a description of all interfaces of the router, find the name of the desired variable referring RFC 2863:

ifDescr OBJECT-TYPE
   SYNTAX  DisplayString (SIZE (0..255))
   ACCESS  read-only
   STATUS  mandatory
   DESCRIPTION
           "A textual string containing information about the
           interface.  This string should include the name of
           the manufacturer, the product name and the version
           of the hardware interface."
   ::= { ifEntry 2 }

You can find ifDescr as a variable name, so translate it to the corresponding OID:

$ snmptranslate -Ts | grep ifDescr
.iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifDescr
$ snmptranslate -On .iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifDescr
.1.3.6.1.2.1.2.2.1.2

...or you can get the OID directly from the variable name:

$ snmptranslate -Of -IR ifDescr
.iso.org.dod.internet.mgmt.mib-2.interfaces.ifTable.ifEntry.ifDescr
$ snmptranslate -On -IR ifDescr
.1.3.6.1.2.1.2.2.1.2

Then, try to execute the snmpwalk command specifying the community name public, the OID 1.3.6.1.2.1.2.2.1.2, and the router's IP address (e.g., 172.16.2.1):

$ snmpwalk -v 2c -c public 172.16.2.1 .1.3.6.1.2.1.2.2.1.2
iso.3.6.1.2.1.2.2.1.2.1 = STRING: "Ethernet0/0"
iso.3.6.1.2.1.2.2.1.2.2 = STRING: "GigabitEthernet0/0"
iso.3.6.1.2.1.2.2.1.2.3 = STRING: "GigabitEthernet1/0"
iso.3.6.1.2.1.2.2.1.2.4 = STRING: "GigabitEthernet2/0"
iso.3.6.1.2.1.2.2.1.2.5 = STRING: "GigabitEthernet3/0"
iso.3.6.1.2.1.2.2.1.2.6 = STRING: "GigabitEthernet4/0"
iso.3.6.1.2.1.2.2.1.2.7 = STRING: "VoIP-Null0"
iso.3.6.1.2.1.2.2.1.2.8 = STRING: "Null0"
iso.3.6.1.2.1.2.2.1.2.9 = STRING: "Loopback0"

In the same way, to retrieve the interface ID list, execute the snmpwalk command with the OID 1.3.6.1.2.1.2.2.1.1 referring RFC 2863:

$ snmpwalk -v 2c -c public 172.16.2.1 .1.3.6.1.2.1.2.2.1.1
iso.3.6.1.2.1.2.2.1.1.1 = INTEGER: 1
iso.3.6.1.2.1.2.2.1.1.2 = INTEGER: 2
iso.3.6.1.2.1.2.2.1.1.3 = INTEGER: 3
iso.3.6.1.2.1.2.2.1.1.4 = INTEGER: 4
iso.3.6.1.2.1.2.2.1.1.5 = INTEGER: 5
iso.3.6.1.2.1.2.2.1.1.6 = INTEGER: 6
iso.3.6.1.2.1.2.2.1.1.7 = INTEGER: 7
iso.3.6.1.2.1.2.2.1.1.8 = INTEGER: 8
iso.3.6.1.2.1.2.2.1.1.9 = INTEGER: 9

When you want to check the status of "GigabitEthernet0/0" (ID: 2) on the router, try to execute the snmpget command with the OID 1.3.6.1.2.1.2.2.1.7.2:

$ snmpget -v 2c -c public 172.16.2.1 .1.3.6.1.2.1.2.2.1.7.2
iso.3.6.1.2.1.2.2.1.7.2 = INTEGER: 1

For "GigabitEthernet3/0" (ID: 5), with the OID 1.3.6.1.2.1.2.2.1.7.5:

$ snmpget -v 2c -c public 172.16.2.1 .1.3.6.1.2.1.2.2.1.7.5
iso.3.6.1.2.1.2.2.1.7.5 = INTEGER: 2

According to RFC 2863, INTEGER: 1 means the interface is up, INTEGER: 2 means the interface is down, respectively:

ifAdminStatus OBJECT-TYPE
   SYNTAX  INTEGER {
               up(1),       -- ready to pass packets
               down(2),
               testing(3)   -- in some test mode
           }
   ACCESS  read-write
   STATUS  mandatory
   DESCRIPTION
           "The desired state of the interface.  The
           testing(3) state indicates that no operational
           packets can be passed."
   ::= { ifEntry 7 }