SNMP Configuration

If you are configuring SNMP for the first time, you might be wondering which SNMP version to configure? Out of the three versions, the version 3 is the most secure. It enables encryption and authentification of the SNMP messages but it's also more complex to configure on some devices. This is why a lot of people choose to use version 2c, which only requires a password (named SNMP Community) and does not encrypt all the messages.

If you are having trouble with version 3 configuration, take a look at version 2c to make sure there is no connectivity issues between the monitoring agent and the device. When it's working with version 2c, then you can give a try with version 3.

There are no real reasons to use SNMP version 1 except if it's the only version available on your device.

SNMP v2c is straightforward to configure: you simply define a community string and enter it in Obkio. The downside is that this string is transmitted in clear-text over the network, meaning anyone able to capture the traffic could read it and potentially use it to poll your devices. That risk can be partially mitigated by restricting SNMP access with ACLs, limiting polling to only trusted sources.

SNMP v3 addresses this more completely by replacing the community string with username/password authentication and encryption, ensuring the credentials and the data exchanged are protected in transit. The trade-off is a slightly more involved setup, but SNMP v2c remains acceptable in a private, isolated management network where traffic visibility is fully controlled.

Here is a list of tutorials and manuals on how to configure SNMP on some devices. Note that only a read-only access is required (not read-write) and that SNMP Traps should not be configured to use the device monitoring feature.

Step-by-step guides written by Obkio are also available below for Cisco IOS, Cisco Meraki, Juniper Junos and Fortinet. These are the same instructions displayed in Step 5 of the Device Creation wizard.

• Cisco IOS
• Cisco Meraki
• Cisco WLC
• Fortinet
• Juniper Junos
• Juniper ScreenOS
• Mikrotik
• Palo Alto
• Sonicwall
• Ubiquiti EdgeRouter
• Watchguard

In the guides below, replace the values between < and > with your own values:

• <OBKIO COLLECTOR (AGENT) PRIVATE IP>: The private IP of the Collector Agent selected for the device.
• <COMMUNITY>: The SNMP community (v2c).
• <USERNAME>, <AUTH PASSWORD> and <PRIV PASSWORD>: The SNMP security name, authentication password and privacy password (v3).
• <DEVICE IP>: The IP address of the device.

The guides use the default SNMP port 161. In the creation wizard, the commands are pre-filled with the values you entered.

Both the CLI and the Web UI are available. The CLI is the preferred method.

Make sure to open a terminal session on the device with the appropriate permissions / privileges.

1. Enter configuration mode

configure terminal

2. Configure an access-list to only permit Obkio Collector (Agent) private IP

ip access-list standard OBKIO_SNMP_POLL_ACL
permit <OBKIO COLLECTOR (AGENT) PRIVATE IP>
deny any
exit

3. Configure SNMP

For SNMP v2c, assign the read-only community (secret) to the ACL. Warning: This secret will be transmitted in clear-text (see SNMP v2c vs. v3).

snmp-server community <COMMUNITY> RO OBKIO_SNMP_POLL_ACL

For SNMP v3, create an SNMP group with authentication and encryption, create an SNMP user and assign it to the group, then bind the group to the ACL.

snmp-server group OBKIO_SNMP_POLL_GROUP v3 priv
snmp-server user <USERNAME> OBKIO_SNMP_POLL_GROUP v3 auth sha <AUTH PASSWORD> priv aes 128 <PRIV PASSWORD>
snmp-server group OBKIO_SNMP_POLL_GROUP v3 priv access OBKIO_SNMP_POLL_ACL

4. Save changes to make them persistent

write memory

The Cisco IOS XE Web UI can vary slightly depending on the platform and software version. If some menu paths don't match exactly, the CLI steps remain the most reliable and consistent method across all platforms and versions. These steps cover the built-in IOS XE WebUI. Make sure the Web UI is accessible by navigating to https://<DEVICE IP> and logging in with your credentials.

1. Configure an access-list to permit only Obkio Collector (Agent) private IP

• Go to Configuration → Security → ACL
• Click Add
• Fill in the details:
  • Name: OBKIO_SNMP_POLL_ACL
  • Type: Standard
• Add a rule to permit the Obkio Collector (Agent) private IP
• Add a second rule to deny any
• Click Apply

2. Configure SNMP

Go to Configuration → Services → SNMP.

For SNMP v2c (Warning: This secret will be transmitted in clear-text):

• Under Communities, click Add
• Fill in the details:
  • Community String: <COMMUNITY>
  • Access: Read Only (RO)
  • ACL: OBKIO_SNMP_POLL_ACL
• Click Apply

For SNMP v3:

• Under Groups, click Add
• Fill in the details:
  • Group Name: OBKIO_SNMP_POLL_GROUP
  • Security Level: authPriv
  • ACL: OBKIO_SNMP_POLL_ACL
• Click Apply
• Under Users, click Add
• Fill in the details:
  • Username: <USERNAME>
  • Group: OBKIO_SNMP_POLL_GROUP
  • Auth Algorithm: SHA
  • Auth Password: <AUTH PASSWORD>
  • Priv Algorithm: AES 128
  • Priv Password: <PRIV PASSWORD>
• Click Apply

3. Save changes

Click the Save icon (floppy disk) in the top right corner, or go to Administration → Save Running Config.

Only the Web UI is available. Log in to the Meraki Dashboard at https://dashboard.meraki.com and select your Organization and Network.

1. Configure SNMP & IP Restriction

Go to Network-wide → General and scroll down to Reporting → SNMP.

For SNMP v2c (Warning: This secret will be transmitted in clear-text, see SNMP v2c vs. v3):

• Set SNMP to Community string
• Enter your community string (<COMMUNITY>)
• In the IP allowed list, add the Obkio Collector (Agent) private IP
• Click Save

For SNMP v3:

• Set SNMP to SNMPv3
• Fill in the details:
  • Username: <USERNAME>
  • Authentication mode: SHA
  • Authentication password: <AUTH PASSWORD>
  • Privacy mode: AES 128
  • Privacy password: <PRIV PASSWORD>
• In the IP allowed list, add the Obkio Collector (Agent) private IP
• Click Save

2. Configure polling

There are two ways of polling Meraki devices using SNMP:

• Cloud polling: Use the Meraki-provided hostname (ex: snmp.meraki.com) and the port shown in the Dashboard.
• Direct device polling: Use the device WAN IP and port 161. See step 3 for the MX Firewall configuration.

3. (Optional) Configure MX Firewall to allow direct device polling

If you need to poll devices directly by IP instead of through the Meraki cloud endpoint, you need to explicitly allow it on the MX firewall:

• Go to Security & SD-WAN → Configure → Firewall
• Scroll down to WAN appliance services
• Find the SNMP row
• Set access to Restricted and add the Obkio Collector (Agent) private IP
• Click Save

Both the CLI and the Web UI are available. The CLI is the preferred method.

Make sure to open a terminal session on the device with the appropriate permissions / privileges.

1. Enter configuration mode

configure

2. Configure a client-list to only permit Obkio Collector (Agent) private IP

set snmp client-list OBKIO_SNMP_POLL_ACL <OBKIO COLLECTOR (AGENT) PRIVATE IP>/32

3. Configure SNMP

For SNMP v2c, create a read-only community and assign it the client-list. Warning: This secret will be transmitted in clear-text (see SNMP v2c vs. v3).

set snmp community <COMMUNITY> authorization read-only
set snmp community <COMMUNITY> client-list-name OBKIO_SNMP_POLL_ACL

For SNMP v3, create the SNMP user, create the SNMP group and assign the user, then bind the client-list to restrict access.

set snmp v3 usm local-engine user <USERNAME> authentication-sha authentication-password <AUTH PASSWORD>
set snmp v3 usm local-engine user <USERNAME> privacy-aes128 privacy-password <PRIV PASSWORD>
set snmp v3 vacm security-to-group security-model usm security-name <USERNAME> group OBKIO_SNMP_POLL_GROUP
set snmp v3 vacm access group OBKIO_SNMP_POLL_GROUP security-model usm security-level privacy read-view all
set snmp v3 snmp-community <COMMUNITY> client-list-name OBKIO_SNMP_POLL_ACL

4. Save changes to make them persistent

commit

Make sure the Web UI is accessible by navigating to https://<DEVICE IP> and logging in with your credentials.

1. Configure a client-list to permit only Obkio Collector (Agent) private IP

• Go to Configuration → Device Settings → SNMP
• Under Client Lists, click Add
• Fill in the details:
  • Name: OBKIO_SNMP_POLL_ACL
  • Clients: Obkio Collector (Agent) private IP
• Click OK

2. Configure SNMP

Go to Configuration → Device Settings → SNMP.

For SNMP v2c (Warning: This secret will be transmitted in clear-text, see SNMP v2c vs. v3):

• Under Communities, click Add
• Fill in the details:
  • Community Name: <COMMUNITY>
  • Authentication: Read Only
  • Client List: OBKIO_SNMP_POLL_ACL
• Click OK

For SNMP v3:

• Under SNMPv3 → USM (Users), click Add
• Fill in the details:
  • Username: <USERNAME>
  • Authentication: SHA + <AUTH PASSWORD>
  • Privacy: AES 128 + <PRIV PASSWORD>
• Click OK
• Under SNMPv3 → VACM (Groups), click Add
• Fill in the details:
  • Group Name: OBKIO_SNMP_POLL_GROUP
  • Security Model: USM
  • Security Level: Privacy
  • Assign the user created above
• Click OK
• Under SNMPv3 → VACM (Security to Group), map the username to the group
• Click OK

3. Save changes

Click Commit in the top right corner to apply and save.

Both the Web UI and the CLI are available. The Web UI is the preferred method.

Make sure the Web UI is accessible by navigating to https://<DEVICE IP> and logging in with your credentials.

1. Allow SNMP on the interface

• Go to Network → Interfaces
• Edit the interface that will receive the SNMP queries
• In the Administrative Access options, enable SNMP
• Click OK

2. Enable SNMP

• Go to System → SNMP
• Enable SNMP Agent
• Fill in the Description, Location and Contact Info fields
• Click Apply

3. Configure SNMP

Go to System → SNMP.

For SNMP v2c (Warning: This secret will be transmitted in clear-text, see SNMP v2c vs. v3):

• In the SNMP v1/v2c table, click Create New
• Enter the Community Name (<COMMUNITY>) and enable the community
• In the Hosts section:
  • Enter the IP Address of the Obkio Collector (Agent) private IP
  • Select the Host Type Accept queries only
• In the Queries section, enable v2c on port 161
• Click OK

For SNMP v3:

• In the SNMP v3 table, click Create New
• Enter the Username, also known as Security Name (<USERNAME>), and enable the user
• Set the Security Level to Authentication
• Select SHA as the Authentication Algorithm
• Enter an Authentication Password (<AUTH PASSWORD>)
• Set the Security Level to Private
• Select AES as the Privacy Algorithm
• Enter a Privacy Password (<PRIV PASSWORD>)
• In the Hosts section, enter the IP Address of the Obkio Collector (Agent) private IP
• In the Queries section, enable queries and enter the port 161
• Click OK

Make sure to open a terminal session on the device with the appropriate permissions / privileges.

1. Allow SNMP on the interface

config system interface
    edit <INTERFACE>
        append allowaccess snmp
    next
end

2. Enable the SNMP agent

config system snmp sysinfo
    set status enable
    set description "<DESCRIPTION>"
    set contact-info "<CONTACT>"
    set location "<LOCATION>"
end

3. Configure SNMP

For SNMP v2c, create a read-only community and permit Obkio Collector (Agent) private IP. Warning: This secret will be transmitted in clear-text (see SNMP v2c vs. v3).

config system snmp community
    edit 1
        set name "<COMMUNITY>"
        set status enable
        config hosts
            edit 1
                set ip <OBKIO COLLECTOR (AGENT) PRIVATE IP> 255.255.255.255
                set host-type query
            next
        end
        set query-v1-status disable
        set query-v2c-status enable
        set query-v2c-port 161
    next
end

For SNMP v3, create an SNMP user and permit Obkio Collector (Agent) private IP.

config system snmp user
    edit "<USERNAME>"
        set status enable
        set queries enable
        set query-port 161
        set notify-hosts <OBKIO COLLECTOR (AGENT) PRIVATE IP>
        set security-level auth-priv
        set auth-proto sha
        set auth-pwd <AUTH PASSWORD>
        set priv-proto aes
        set priv-pwd <PRIV PASSWORD>
    next
end

If you need help configuring your network device, get in touch with our Support Team.