Poll a router and a switch with SNMP gets, a getnext and a set
Task
Turn a router and a switch into SNMP agents and use a PC's MIB Browser as the manager. You send gets for named OIDs, decode a sysUpTime value from timeticks into days and hours, walk one step with getnext, and write a value with a set, seeing why a set needs the read-write community and why the read-only one is refused. You also make the classic manager mistake, the wrong community string, and see what it looks like from both ends. You finish by removing the read-write community, as lesson 27's good practice says. At the end you can explain the manager, agent, MIB, OID, get, getnext, set and UDP 161 from things you did.
Topology
Devices
| Device | Model | Role |
|---|---|---|
| R1 | ISR4331 | SNMP agent, the LAN gateway |
| S1 | 2960-24TT | SNMP agent, managed through VLAN 1 |
| PC1 | PC-PT | SNMP manager (MIB Browser) |
Links
| From | To |
|---|---|
| R1 G0/0/1 | S1 G0/1 |
| PC1 Fa0 | S1 Fa0/1 |
Addressing
| Device | Interface | Address | Default gateway |
|---|---|---|---|
| R1 | G0/0/1 | 192.168.10.1/24 | none |
| S1 | VLAN 1 | 192.168.10.5/24 | 192.168.10.1 |
| PC1 | NIC | 192.168.10.10/24 | 192.168.10.1 |
Steps
- Drag each device from the Topology onto the workspace and set its display name (click the device, Config tab, Display Name) to the name in the Devices table. Cable the ports the Links table lists: Packet Tracer's automatic connection type picks the right cable, or use a copper cross-over between two routers or between a router and a PC or server. If a router asks whether to enter the initial configuration dialog, answer
no. - Address R1 and give S1 a management address on VLAN 1. Give PC1 its address and gateway (Desktop > IP Configuration).
Router> enable
Router# configure terminal
Router(config)# hostname R1
R1(config)# interface g0/0/1
R1(config-if)# ip address 192.168.10.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# end
Switch> enable
Switch# configure terminal
Switch(config)# hostname S1
S1(config)# interface vlan 1
S1(config-if)# ip address 192.168.10.5 255.255.255.0
S1(config-if)# no shutdown
S1(config-if)# exit
S1(config)# ip default-gateway 192.168.10.1
S1(config)# end
C:\> ping 192.168.10.5
- Make both devices agents. R1 gets a read-only community and, for now, a read-write one so you can see a set work; S1 gets read-only only. These strings are lab-only:
R1# configure terminal
R1(config)# snmp-server community lab-only-ro RO
R1(config)# snmp-server community lab-only-rw RW
R1(config)# end
S1# configure terminal
S1(config)# snmp-server community lab-only-ro RO
S1(config)# end
- Break and fix: the wrong community. On PC1 open Desktop > MIB Browser and click Advanced. Set Address 192.168.10.1, Port 161, Read Community
public, SNMP Version v2c, and click OK. In the MIB tree open .iso.org.dod.internet.mgmt.mib-2.system, select sysName, choose Get as the operation and click GO. No value comes back: R1 silently ignores a request with a community it does not know, so to the manager it looks exactly like a device that is down. Open Advanced again, set Read Community tolab-only-ro, and repeat the get. The result table now shows sysName with the value R1. - Get sysUpTime the same way. The value is in timeticks, hundredths of a second. Convert it on paper as lesson 27 does: divide by 100 for seconds, then take out days (86,400 seconds), hours (3,600) and minutes (60). Get sysUpTime again a minute later and confirm it grew by about 6,000 ticks.
- Walk one step with getnext. Select sysDescr, choose Get Next and click GO. The agent answers with the object after sysDescr in the tree, not sysDescr itself. Repeat Get Next from each answer to walk through the system group: that is how a manager reads a table it does not know the size of.
- Poll the switch too. In Advanced set Address 192.168.10.5 with Read Community
lab-only-roand get sysName. The value is S1. A manager polls every device this way to build its inventory. - Write with a set. Point the browser back at 192.168.10.1. Set Write Community to
lab-only-ro, select sysLocation, choose Set, enter the valuelab-bench-2as an OctetString and click GO: the set is refused, because a read-only community cannot write. Change Write Community tolab-only-rwand repeat the set, then get sysLocation to read backlab-bench-2. - See the clear text. Switch Packet Tracer to Simulation mode, set the event list filter to SNMP only, and repeat the sysName get. Click the SNMP packet and open its details: it is UDP to destination port 161, and with SNMPv2c nothing in it is encrypted, including the community string. Return to Realtime mode.
- Apply lesson 27's good practice: no read-write community unless a tool needs one.
R1# configure terminal
R1(config)# no snmp-server community lab-only-rw
R1(config)# end
Repeat the set with Write Community lab-only-rw. It is now refused as well.
Verify
R1# show running-config | include snmp-server
S1# show running-config | include snmp-server
Expected output: on R1, the line snmp-server community lab-only-ro RO and no lab-only-rw line (IOS also records step 8's set as snmp-server location lab-bench-2). On S1, snmp-server community lab-only-ro RO. In the MIB Browser, a get of sysName with Read Community lab-only-ro returns R1 from 192.168.10.1 and S1 from 192.168.10.5.
Save your work
Save the topology as ccna-lab27-snmp.pkt (File > Save As).
Notes
Traps, informs and SNMPv3 are not practised here. Packet Tracer has no trap receiver to watch, and its SNMPv3 support on IOS devices cannot be relied on, so the lab keeps to v2c polling. On real equipment lesson 27's advice stands: SNMPv3 at authPriv, and any remaining v2c community read-only, long, random and limited by an ACL to the monitoring server.
This is an independent study companion for the Cisco CCNA 200-301 v2.0 exam and is not produced by or endorsed by Cisco. Cisco, CCNA and IOS are trademarks of Cisco Systems, Inc.
This is an independent study companion for Cisco CCNA 200-301 and is not produced by or endorsed by CompTIA.