PlantUML DiagramSNMP Architecture
A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
SNMP is the protocol network engineers love to hate. It's verbose, security in v2c is terrible, and the OIDs are cryptic. But for polling device metrics — CPU, memory, interface counters, uptime — it's the standard. Every monitoring tool (Zabbix, LibreNMS, PRTG, SolarWinds, Datadog Network) speaks SNMP. If you run networks at any scale, you use it.
The SNMP manager is your monitoring server. Each device runs an SNMP agent that responds to queries and sends unsolicited traps. The manager polls devices periodically for metrics and receives traps when events occur. Traps are real-time notifications — interface down, CPU spike, config change.
Every monitored value has a unique Object Identifier (OID) — a dotted-decimal string like `1.3.6.1.2.1.2.2.1.10.1`. MIBs (Management Information Bases) are text files that translate OIDs to human-readable names. `1.3.6.1.2.1.2.2.1.10.1` is `IF-MIB::ifInOctets.1` — the inbound byte counter on interface 1.
Monitoring tools usually ship with MIB files for major vendors. Loading Cisco's MIBs into your monitoring tool lets it display named values instead of OIDs. Without MIBs, you're reading hex — with them, you're reading interface statistics.
| Feature | SNMPv2c | SNMPv3 |
|---|---|---|
| Authentication | Community string (plaintext) | Username + password (HMAC) |
| Encryption | None | DES, AES-128, AES-256 |
| Security level | Poor | Strong |
| Configuration | Simple | More complex |
| Recommended? | Legacy/isolated networks only | Yes, for anything production |
SNMPv2c's community string is essentially a password transmitted in plaintext over the network. Anyone with a packet capture can read it. For internal networks on isolated management VLANs, this is sometimes considered acceptable. For anything crossing untrusted links, SNMPv3 with authentication and encryption is required.
! SNMPv2c — legacy but commonR1(config)# snmp-server community MyPublicString ROR1(config)# snmp-server community MyPrivateString RWR1(config)# snmp-server location DataCenter-Rack-42R1(config)# snmp-server contact netops@example.comR1(config)# snmp-server host 10.10.20.100 version 2c MyPublicStringR1(config)# snmp-server enable traps! SNMPv3 — modern, secureR1(config)# snmp-server group MONITORING v3 authR1(config)# snmp-server user monitor MONITORING v3 auth sha MyAuthPass123R1(config)# snmp-server host 10.10.20.100 version 3 auth monitorR1(config)# snmp-server enable traps! VerifyR1# show snmp userR1# show snmp group
Never use 'public' or 'private' as SNMP community strings. These are the defaults and are scanned by attackers constantly. Never use RW (read-write) community strings unless absolutely required — most monitoring only needs read access. Always restrict SNMP access with ACLs.
! Only allow SNMP from the management serverR1(config)# access-list 10 permit 10.10.20.100R1(config)# access-list 10 deny any logR1(config)# snmp-server community MyPublicString RO 10! Or use a specific source interfaceR1(config)# snmp-server source-interface traps loopback0
You need to monitor routers across a WAN that includes unencrypted links. SNMP data traverses those links. Which configuration is appropriate?
Select the safest next action.
Section 13 complete. DHCP, DNS, NAT, NTP, syslog, and SNMP — the services that make a network operationally usable. Section 14 covers first-hop redundancy — how to eliminate the default gateway as a single point of failure.
Finish the lesson once you have worked through the material. This awards ★ 35 XP.