Poll a router and a switch with SNMP gets, a getnext and a set

short · 35 min · Packet Tracer · Exam topic 5.4

Task

Turn a router and a switch into SNMP agents and use a PC's MIB Browser as the manager. You send gets for named OIDs, decode a sysUpTime value from timeticks into days and hours, walk one step with getnext, and write a value with a set, seeing why a set needs the read-write community and why the read-only one is refused. You also make the classic manager mistake, the wrong community string, and see what it looks like from both ends. You finish by removing the read-write community, as lesson 27's good practice says. At the end you can explain the manager, agent, MIB, OID, get, getnext, set and UDP 161 from things you did.

Topology

Devices

Device Model Role
R1 ISR4331 SNMP agent, the LAN gateway
S1 2960-24TT SNMP agent, managed through VLAN 1
PC1 PC-PT SNMP manager (MIB Browser)

Links

From To
R1 G0/0/1 S1 G0/1
PC1 Fa0 S1 Fa0/1

Addressing

Device Interface Address Default gateway
R1 G0/0/1 192.168.10.1/24 none
S1 VLAN 1 192.168.10.5/24 192.168.10.1
PC1 NIC 192.168.10.10/24 192.168.10.1

Steps

  1. Drag each device from the Topology onto the workspace and set its display name (click the device, Config tab, Display Name) to the name in the Devices table. Cable the ports the Links table lists: Packet Tracer's automatic connection type picks the right cable, or use a copper cross-over between two routers or between a router and a PC or server. If a router asks whether to enter the initial configuration dialog, answer no.
  2. Address R1 and give S1 a management address on VLAN 1. Give PC1 its address and gateway (Desktop > IP Configuration).
Router> enable
Router# configure terminal
Router(config)# hostname R1
R1(config)# interface g0/0/1
R1(config-if)# ip address 192.168.10.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# end
Switch> enable
Switch# configure terminal
Switch(config)# hostname S1
S1(config)# interface vlan 1
S1(config-if)# ip address 192.168.10.5 255.255.255.0
S1(config-if)# no shutdown
S1(config-if)# exit
S1(config)# ip default-gateway 192.168.10.1
S1(config)# end
C:\> ping 192.168.10.5
  1. Make both devices agents. R1 gets a read-only community and, for now, a read-write one so you can see a set work; S1 gets read-only only. These strings are lab-only:
R1# configure terminal
R1(config)# snmp-server community lab-only-ro RO
R1(config)# snmp-server community lab-only-rw RW
R1(config)# end
S1# configure terminal
S1(config)# snmp-server community lab-only-ro RO
S1(config)# end
  1. Break and fix: the wrong community. On PC1 open Desktop > MIB Browser and click Advanced. Set Address 192.168.10.1, Port 161, Read Community public, SNMP Version v2c, and click OK. In the MIB tree open .iso.org.dod.internet.mgmt.mib-2.system, select sysName, choose Get as the operation and click GO. No value comes back: R1 silently ignores a request with a community it does not know, so to the manager it looks exactly like a device that is down. Open Advanced again, set Read Community to lab-only-ro, and repeat the get. The result table now shows sysName with the value R1.
  2. Get sysUpTime the same way. The value is in timeticks, hundredths of a second. Convert it on paper as lesson 27 does: divide by 100 for seconds, then take out days (86,400 seconds), hours (3,600) and minutes (60). Get sysUpTime again a minute later and confirm it grew by about 6,000 ticks.
  3. Walk one step with getnext. Select sysDescr, choose Get Next and click GO. The agent answers with the object after sysDescr in the tree, not sysDescr itself. Repeat Get Next from each answer to walk through the system group: that is how a manager reads a table it does not know the size of.
  4. Poll the switch too. In Advanced set Address 192.168.10.5 with Read Community lab-only-ro and get sysName. The value is S1. A manager polls every device this way to build its inventory.
  5. Write with a set. Point the browser back at 192.168.10.1. Set Write Community to lab-only-ro, select sysLocation, choose Set, enter the value lab-bench-2 as an OctetString and click GO: the set is refused, because a read-only community cannot write. Change Write Community to lab-only-rw and repeat the set, then get sysLocation to read back lab-bench-2.
  6. See the clear text. Switch Packet Tracer to Simulation mode, set the event list filter to SNMP only, and repeat the sysName get. Click the SNMP packet and open its details: it is UDP to destination port 161, and with SNMPv2c nothing in it is encrypted, including the community string. Return to Realtime mode.
  7. Apply lesson 27's good practice: no read-write community unless a tool needs one.
R1# configure terminal
R1(config)# no snmp-server community lab-only-rw
R1(config)# end

Repeat the set with Write Community lab-only-rw. It is now refused as well.

Verify

R1# show running-config | include snmp-server
S1# show running-config | include snmp-server

Expected output: on R1, the line snmp-server community lab-only-ro RO and no lab-only-rw line (IOS also records step 8's set as snmp-server location lab-bench-2). On S1, snmp-server community lab-only-ro RO. In the MIB Browser, a get of sysName with Read Community lab-only-ro returns R1 from 192.168.10.1 and S1 from 192.168.10.5.

Save your work

Save the topology as ccna-lab27-snmp.pkt (File > Save As).

Notes

Traps, informs and SNMPv3 are not practised here. Packet Tracer has no trap receiver to watch, and its SNMPv3 support on IOS devices cannot be relied on, so the lab keeps to v2c polling. On real equipment lesson 27's advice stands: SNMPv3 at authPriv, and any remaining v2c community read-only, long, random and limited by an ACL to the monitoring server.

This is an independent study companion for the Cisco CCNA 200-301 v2.0 exam and is not produced by or endorsed by Cisco. Cisco, CCNA and IOS are trademarks of Cisco Systems, Inc.

This is an independent study companion for Cisco CCNA 200-301 and is not produced by or endorsed by CompTIA.