Configuring SNMP v2c and v3

Overview: SNMP Monitoring in Backup Manager

SNMP (Simple Network Management Protocol) allows Backup Manager to monitor your network devices in real-time. You can choose between SNMPv2c (community-based) or SNMPv3 (user-based security).

What SNMP Monitoring Provides:

• CPU Usage: Monitor processor utilization on network devices
• Memory Usage: Track memory consumption and availability
• Interface Statistics: Monitor bandwidth, errors, and interface status
• Device Uptime: Track how long devices have been running
• Hardware Inventory: Collect serial numbers, firmware versions, model info
• Neighbor Discovery: Discover network topology via LLDP/CDP

SNMP Version Comparison:

Feature	SNMPv2c	SNMPv3
Authentication	Community string (plain text)	Username + password (hashed)
Encryption	None	AES/DES encryption available
Security Level	Low	High (recommended)
Setup Complexity	Simple	More complex

Step 1: Access SNMP Settings for a Device

SNMP settings are configured per-device from the SNMP Monitoring dashboard.

How to Access:

• Navigate to SNMP Monitoring → Overview in the sidebar
• Find the device you want to configure in the device list
• Click the SNMP Settings button (gear icon) for that device

The SNMP Settings Modal:

• Version: Select SNMP version (No SNMP, v2c, or v3)
• Community/Credentials: Authentication settings based on version
• Port: SNMP port (default 161)
• Poll Interval: How often to poll the device
• Enabled: Toggle SNMP monitoring on/off

Note: You must have devices added to Backup Manager before configuring SNMP. See "Adding Network Devices" guide if needed.

Step 2: Configure SNMPv2c (Community-Based)

SNMPv2c uses a community string for authentication. It's simple to set up but less secure than v3.

To Configure SNMPv2c:

• Select v2c (Community-based) from the Version dropdown
• Enter the Community String (must match your device configuration)
• Leave the port as 161 unless your device uses a different port
• Ensure SNMP Monitoring Enabled is checked

Common Community Strings:

• public - Default read-only community (insecure, change this!)
• private - Default read-write community (never use this!)
• Use a custom string like MyNetw0rk#2024 for better security

Device Configuration Example (Cisco IOS):

! Configure read-only community string
snmp-server community MyNetw0rk#2024 RO

! Optional: Restrict to specific management IP
snmp-server community MyNetw0rk#2024 RO 10
access-list 10 permit host 192.168.1.100

Step 3: Configure SNMPv3 - Basic Setup

SNMPv3 provides authentication and encryption for secure monitoring. It's recommended for production networks.

To Start SNMPv3 Configuration:

• Select v3 (User-based Security) from the Version dropdown
• Enter the Username (must match the user configured on your device)
• Select the Security Level

SNMPv3 Security Levels:

• noAuthNoPriv: Username only, no authentication or encryption (not recommended)
• authNoPriv: Authentication required, no encryption
• authPriv: Full authentication and encryption (most secure, recommended)

For maximum security, always use authPriv security level in production environments.

Step 4: Configure SNMPv3 Authentication

When using authNoPriv or authPriv security levels, you must configure authentication settings.

Authentication Protocol Options:

• MD5: Message Digest 5 (older, less secure)
• SHA: Secure Hash Algorithm (recommended minimum)
• SHA-256: SHA with 256-bit hash (most secure)

Authentication Password Requirements:

• Minimum 8 characters required
• Must match the password configured on your network device
• Use strong passwords with letters, numbers, and special characters

Configuration:

• Select Auth Protocol (SHA recommended)
• Enter the Auth Password (minimum 8 characters)
• Click the eye icon to show/hide the password

Step 5: Configure SNMPv3 Privacy (Encryption)

When using authPriv security level, you must also configure privacy (encryption) settings.

Privacy Protocol Options:

• DES: Data Encryption Standard (56-bit, older)
• AES: Advanced Encryption Standard (128-bit, recommended)
• AES-256: AES with 256-bit encryption (most secure)

Privacy Password Requirements:

• Minimum 8 characters required
• Must match the privacy password on your network device
• Can be the same as or different from the auth password

Configuration:

• Select Privacy Protocol (AES recommended)
• Enter the Privacy Password (minimum 8 characters)

Note: Privacy settings are only shown when authPriv security level is selected.

Step 6: Device Configuration Examples

Your network device must be configured to match the SNMP settings in Backup Manager.

Cisco IOS/IOS-XE SNMPv3 Configuration:

! Create SNMPv3 group with read-only access
snmp-server group MONITORING v3 priv read SNMP-RO

! Create SNMPv3 user with auth and priv
snmp-server user backupmanager MONITORING v3 auth sha AuthPass123! priv aes 128 PrivPass456!

! Create view for read-only access
snmp-server view SNMP-RO iso included

Aruba AOS-CX SNMPv3 Configuration:

snmpv3 user backupmanager auth sha auth-pass AuthPass123! priv aes priv-pass PrivPass456!

Juniper JunOS SNMPv3 Configuration:

set snmp v3 usm local-engine user backupmanager authentication-sha authentication-password AuthPass123!
set snmp v3 usm local-engine user backupmanager privacy-aes128 privacy-password PrivPass456!

Step 7: Test the SNMP Connection

Before saving, test the SNMP connection to verify your settings are correct.

To Test Connection:

• Click the Test Connection button
• Wait for the test results to appear
• Check for success or error messages

Test Results:

• Success: SNMP connection working, device responds
• Timeout: Device not responding (check IP, firewall)
• Auth Error: Wrong community string or credentials

Troubleshooting Failed Tests:

• Verify the device IP address is correct
• Check if UDP port 161 is open on firewalls
• Verify SNMP is enabled on the device
• Confirm community string/credentials match exactly
• Check for access lists restricting SNMP on the device

Step 8: Save and Verify

Once the test is successful, save the settings and verify monitoring is working.

To Save:

• Click Save Settings to apply the configuration
• The modal will close and device will be marked for polling

Verify Monitoring is Working:

• Check the device card on the SNMP Dashboard
• CPU, Memory, and Uptime should show real data
• Interface statistics should populate
• Last poll time should update

After Successful Configuration:

• Device will be polled automatically based on the global poll interval
• Historical data will be collected for trending
• Alerts can be configured for threshold violations
• Device will appear in network topology with proper connections

Best Practices for SNMP Configuration

Security Recommendations:

• Use SNMPv3: Always prefer v3 over v2c for production networks
• Use authPriv: Enable both authentication and encryption
• Strong Passwords: Use complex passwords (12+ characters) for auth and priv
• Change Default Strings: Never use "public" or "private" in production
• Restrict Access: Use ACLs on devices to limit SNMP to management IPs

Performance Recommendations:

• Poll Interval: 5 minutes (300 seconds) is a good balance
• Don't Over-Poll: Polling too frequently can impact device performance
• Monitor Poll Errors: Check for devices with consistent timeout errors

Organization Tips:

• Use the same SNMPv3 credentials across all devices when possible
• Document your SNMP settings securely
• Configure all devices before running bulk discovery/polling

Troubleshooting Common Issues:

• No response: Check firewall rules for UDP 161
• Auth errors: Verify credentials match exactly (case-sensitive)
• Partial data: Some devices may not support all OIDs
• Engine ID errors: Some devices require specific engine ID configuration