SNMP V3 Trap Configuration and Tests


Question

How to configure SNMPv3 trap target?


Solution

This article explains the procedure to configure SNMPv3 trap targets on SNMPv3 enabled devices.

NOTE: The configurations explained in this article are already configured with:

Appliance Pre-requisites

admin@Branch1-cli(config)% show confdConfig snmpAgent snmpEngine snmpEngineID
snmpEngineID 80:00:04:d2:04:76:65:72:73:61;

or
Run below shell command on latest release 
[admin@CPE2: ~] # vsh engine-id
80:00:a5:77:01:0a:c0:85:0c

Procedure

Follow these steps to configure SNMPV3 trap.

1. Create a user called test1.
Example:

    admin@Branch1-cli(config)% show snmp usm
    local {
        user test1 {
            auth {
                md5 {
                    password versa123;
                }
            }
            priv {
                des {
                    password versa123;
                }
            }

NOTE: SNMP uses security name for V3 users. This is configurable under snmp usm local user <> sec-name, but is not saved when it is the same as the user name. ConfD logs might print a debug stating that security name for V3 user is missing. This can be ignored.

2. Create a separate group for v3 users (v3grp) with auth-priv and add usual visibility. 

3. Add a user test1 to the group v3grp.
Example:

group v3grp {
        member test1 {
            sec-model [ usm ];
        }
        access usm auth-priv {
            read-view   internet;
            notify-view internet;
        }
    }
    view internet {
        subtree 1.2 {
            included;
        }
        subtree 1.3 {
            included;
        }
        subtree 1.3.6.1 {
            included;
        }
    }

4. Configure a target for Testv3 that is listening on port 5000. 
Example:

target Testv3 {
        ip       172.16.11.10;
        udp-port 5000;
        tag      [ std_v3_inform std_v3_trap ];
        timeout  1500;
        retries  3;
        usm {
            user-name test1;
            sec-level auth-priv;
        }
    }

The target will know the Engine ID and user.

NOTE: A target can have parameters for only one version. You need to configure separate targets if you want to send both v3 and non v3 traps to the same destination.


5. Follow these steps to configure snmptrapd (the trap receiver):

a. Configure users with the createUser directive.

b. Associate the user with the remote Engine ID of the agent from where the trap originates (as shown in Pre-Requisites section).

c. If you want to receive traps for a user from more than one agent, you will need a separate createUser config for each.

d. In case of SNMP Inform, Engine ID need not be specified.

Example:

$ cat snmptrapd.conf
    engineID fromthisstring
    doNotFork yes

    # An entry for trap (here, we have to explicitly specify FlexVNF's engine ID)
    createUser -e 0x800004d2047665727361 test1 MD5 versa123 DES versa123

    # An entry for inform (no need for engine ID)
    createUser test1 MD5 versa123 DES versa123
    authUser log,execute,net test1

NOTE:

authUser log,execute,net test1 noauth

Testing SNMPv3 Trap on Versa FlexVNF

Refer to this step to test SNMPv3 traps on Versa FlexVNF.

From the OS shell enter:
# vsh connect vmod

vmod> test trap appRunning FlexVNF Test3 2 163 3 2 Ani1 Branch1 VMOD
    Trap: appRunning
    Successfully sent trap appRunning with 11 varbinds :-)

NOTE: Here, alarmClass = 2 and alarmProbableCause = 163 (these have to be set correctly [as per IANA-ITU-ALARM-TC-MIB]).

Testing SNMPv3 Trap on Remote Host

Refer to this step to test SNMPv3 Trap on a remote host.

$ snmptrapd  -M /tmp/versa-mibs -m ALL -Le -f -C -c snmptrapd.conf 172.16.11.10:5000

-M indicates the directory where versa-mibs.tar.gz has been untar'd. Change the directory appropriately.

Troubleshooting

On FlexVNF

On receiver