SNMPv3 Trap processing

Products

VMware Smart Assurance Network Observability

Issue/Introduction

Symptoms:

How to configure a Trap Receiver to Process SNMPv3 Traps?
The current documentation to create a seedfile for the Smarts Trap Adapter, for use with SNMPv3 traps does not specify the fact that each seedfile entry must be on a single line.

Environment

All Supported Smarts versions

Cause

SNMPv3 traps require additional authentication steps to process it internally. The document shows a multi-line entry in the seedfile in the example for readability, however the trap adapter requires each seedfile entry to be on a single line to avoid parsing the seedfile incorrectly.

Resolution

Step 1. Use sm_edit to make entry in seedfile located in <SAMBase>/smarts/conf/icoi

<IP Address>
SNMPVERSION=V3
USER=<username>
AUTHPROTOCOL=SHA
AUTHPASS=<Authpassword>
PRIVPROTOCOL=AES
PRIVPASS=<Privpassword>
ENGINEID=

NOTE: Format of the seed file must have a host IP, or Name and the information above as needed on a single line.
NOTE: The seedfile is used to populate sm_trapd with snmp v3 credentials for trap processing, hence the EngineID is needed and is required to be unique as per the RFC standards (external link: rfc3411).

Opening the seed file with sm_edit, the seed file should look like this example before saving, after saving the AUTHPASS and the PRIVPASS will be encrypted as a function of the first line in the seed file that is required for encryption.

#<encrypted seed>:1.0:AUTHPASS,PRIVPASS
<IP Address> USER=<User Name> SNMPVERSION=V3 AUTHPROTOCOL=SHA AUTHPASS=<Authentication Password> PRIVPROTOCOL=DES PRIVPASS=<Previlage Password> ENGINEID=<Engine ID>
<IP Address> USER=<User Name> SNMPVERSION=V3 AUTHPROTOCOL=SHA AUTHPASS=<Authentication Password> PRIVPROTOCOL=DES PRIVPASS=<Previlage Password> ENGINEID=<Engine ID>

NOTE: You cannot use the "=" in the password field, currently testing what special characters are allow in the password field.
Also, the seedfile uses the colon ' : " as a a delimiter for specifying multiple host IP/ host names, hence : is not allowed in password field.

Step 2. Create a trap definition, enable DEBUG and LOGGING (for treoubleshooting) in trap_mgr.conf:

    BEGIN_TRAP <OID Number> <Generic Type> <Specific Type>
     EventName: TestTrap
     ClassName: Host
     InstanceName: $SYS$
     SysNameOrAddr: $SYS$
     Expiration: <Numeric Value>
     State: NOTIFY
     UnknownAgent: CREATE
     EventType: MOMENTARY
     ClearOnAcknowledge: TRUE
     LogFile: <Log file to print output>
     EventText: $V1$, $V2$, $V3$
    END_TRAP

Step 3. Adjust the <Basedir>/smarts/conf/trapd/trapd.conf file to forward traps to trap adapter or respective trap receiver.
FORWARD: * <OID value> * * -nosmtrapaddr localhost:9101

Optional - (Force seed file to be loaded)
Step 4. Start Trap Receiver/Exploder (ensure that OI is running before starting TA) and subscribe SAM to OI.

      ./sm_trapd --name=<Trap Exploder Name> --config=trapd --port=<Port Number> --rules=default --output=<Output log file name> --daemon --loglevel=Critical --loglevel=Alert --seed=seedfile

     ./sm_trapd --name=<Trap Receiver Name> --server=<OI domain name> --config=icoi --port=<Port Number> --model=sm_actions --daemon --output=<Output log file name> --rules=icoi-trapd/trap_mgr_parse.asl --seed=seedfile

Step 5. Import the seedfile into the Local Credentials Database.

     ./sm_adapter -s <Trap Exploder Name> -D seed=<seedfile name> trapd/importSeedFile.asl
     ./sm_adapter -s <Trap Receiver Name> -D seed=<seedfile name> trapd/importSeedFile.asl

Step 6. Send test trap:

     ./sm_snmp -d <Trap Exploder IP address> -p <Port Number -s 3 -u <username> -e 1234567890ABCDEF -a SHA -b AES -x <Authentication Password> -y <Privilage Password) trap <IP address of source device as in step 1> .1.3.6.1.4.1.41263.1 6 1 0 .1.3.6.1.4.1.41263.1.1.1 s "Varbind_1" .1.3.6.1.4.1.41263.1.1.2 s "Varbind_2" .1.3.6.1.4.1.41263.1.1.3 s "Varbind_3"

Additional Information

./sm_snmp --help
Usage: sm_snmp [options...] <command>
Commands:

trap <agent> <oid> <generic> <specific> <uptime> <varbind> ...
Send a trap.
trapd Receive traps.
support Test agent capabilities.
Command Arguments:
<oid> should be an OID in dotted notation with a leading dot.
<varbind> should be a triplet:
<oid> <type> <value>
<type> should be one of:
i -- INTEGER
b -- BIT-STRING
s -- OCTET-STRING
a -- IP-ADDRESS
c -- COUNTER
g -- GAUGE
u -- UNSIGNED-INTEGER
t -- TIME-TICKS
C -- COUNTER-64
o -- OBJ-ID
q -- OPAQUE
n -- NULL (<value> is ignored)
Target Options:
--dest=<destination> Destination host or IP address; default localhost.
Also -d <destination>.
--port=<port> Alternate UDP port;
default 161.
Also -p <port>.
--snmp=<version> SNMP version.
Supported <SNMP version>s are 1, 2c and 3;
default 1. Also -s <SNMP version>.
--community=<name> Community string;
default "public" for get, "" for set.
Also -c <name>.
--user=<username> User name for SNMPv3 requests. This user should
be defined on the responding agent.
Default empty. Also -u <username>.
--authengine=<engine ID> Engine ID of the authoritative SNMP Engine for
SNMPv3 trap handling; Should be 5-32 octets in
HEX format. Default empty. Also -e <engine ID>.
--localengine=<engine ID> Engine ID of the local SNMP Engine for SNMPv3
SNMPv3 trap handling; Should be 5-32 octets in
HEX format. may be equal to authengine
(to receive informs), or different (for traps)
default 000002DD<IP Address><Port>0000.
Also -E <engine ID>.
--boots=<num> Number of times that this SNMP engine has
initialized or reinitialized itself since its
initial configuration.This is SNMPv3 security
parameter.
Also -B <num>.
--boottime=<num> Time that the (simulated) device was rebooted,
in seconds since the epoch. This is used to
compute the timestamp sent in an SNMPv3 message
as part of SNMPv3 authentication.
Also -T <num>.
--auth=<auth protocol> Authentication protocol to use on SNMPv3
requests; Possible values MD5/SHA/SHA256/SHA512/NONE;
default NONE. Also -a <auth protocol>.
--priv=<priv protocol> Use privacy on SNMPv3 requests. One of
DES/3DES/AES/AES128/AES192/AES256/NONE.
Defaults to NONE if left blank
Note that AES is 128-bit AES.
Also -b <priv protocol>
--authPass=<password> Password to use for authentication of SNMPv3
messages. If an auth protocol is specified
without giving an authPass, the user will be
prompted to enter an authPass interactively
on the terminal (with echo turned off).
Also -x <password>.
--privPass=<password> Password to use for encryption on SNMPv3 messages.
If a priv protocol is specified without giving a
privPass, the user will be prompted to enter a
privPass interactively on the terminal (with echo
turned off). Also -y <password>.
--context=<name> Context name for View Based Access Control on
SNMPv3 requests; default empty.
Also -z <name>.
--nosmtrapaddr Disables addition of extra Smarts MIB varbinds to
the trap, representing the trap address type and
trap address.
Retransmission Options:
--timeout=<num> Timeout, in milliseconds; default 500.
Also -t <num>.
--retries=<num> Number of retries; default 3. Also -r <num>.
--policy=<policy> Retransmission policy.
<policy>: One of Constant, Linear or Exponential;
default Exponential.
Also -P <policy>.
Output Options:
--dump Dump incoming and outgoing packets trace.
Also -D.
--outstr=<file> Print all output to <file>; default stdout.
Also -o <file>.
Formatting Options:
--fmt=<flags> Formatting flags.
Multiple flags can be specified
as a comma-separated list.
--eq=<string> Formatting equal-sign; default " = ".
--eol=<string> Formatting end-of-line; default "\n".
--sep=<string> Formatting separator; default " ".
--stub=<char> Formatting stub-character; default '.'.
--width=<num> Formatting width for numeric values.
Formatting Flags:
leftJust Left justify numeric output.
forceSign Force "+" sign on positive numeric output.
leadingSpace Include leading space on positive numeric output.
zeroFill Fill numeric output with zeroes.
octal Format numeric output in base 8.
hex Format numeric output in base 16.
decimal Format numeric output in base 10.
lowerCase Use lower case hex (a-f) for numeric output.
showRadix Show integer radix (0nnn or 0Xnnn).
throwIfTooBig Throw exception if numeric field overflows.
rawStr Format octet strings as is.
intStr Format octet strings as sequence of integers.
printStr Format octet strings as printable string.
intOctetStr Force formatting of octet string as an "intStr".
spaceIsPrintable Don't replace non-printable spaces.
ignoreLastNulls Ignore last NUL bytes.
noSeparators No separators for "intStr" and "intOctetStr".
escPrint Escape un-printable characters with numeric value.
stubPrint Replace un-printable characters with "stub".
intPrint Replace all characters with their numeric value.
typeTag Prepend value with type tag.
locale Locale-specific formatting.
printTime Format timeTicks as a printable string.

Standard Options:
--help Print help and exit.
--version Print program version and exit.
--daemon Run process as a daemon.
--logname=<name> Use <name> to identify sender in the system log.
Default: The program's name.
--loglevel=<level> Minimum system logging level. Default: Error.
--errlevel=<level> Minimum error printing level. Default: Warning.
--tracelevel=<level> Minimum stack trace level. Default: Fatal.
<level>: One of None, Emergency, Alert,
Critical, Error, Warning, Notice, Informational,
or Debug. Fatal is a synonym for Critical.
--facility=<facility> Non-Windows only. A case-insensitive string that
identifies which facility to use for syslog messages.
<facility>: One of Cron, Daemon, Kern, Local0-Local7,
Lpr, Mail, News, Uucp, User. Default: Daemon.
--output[=<file>] Redirect server output (stdout and stderr). The
file name is <file>, or the --logname value if
<file> is omitted. Log files are always placed
in $SM_LOGFILES or $SM_WRITEABLE/logs.
--accept=<host-list> Accept connections only from hosts on
<host-list>, a comma-separated list of host
names and IP addresses. --accept=any allows
any host to connect. Default: --accept=any.
--useif=<ip-address> Use this IP address as the source/destination
interface address for SNMP and ICMP packets.
--privopen=<priv-list> List of sockets that require privilege state before
changed process to run in the account specified
by --run-as-user. The <priv-list> is a comma
separated list of type[:family]:protocol[,#count].
Type is TCP, UDP or IP. Family is v6 or v4.
When the type is IP, Protocol is the protocol number
(Eg: 1 for ICMP, 58 for ICMPv6). When the type is
TCP/UDP, Protocol is the port number.
--run-as-user=username Run as this user after opening privilege sockets.
-- Stop scanning for options.

For more information:
file:/opt/smarts/SAM/smarts/doc/html/usage/index.html

Attachments

SAM Patform adapter guide.pdf get_app