Multiple polling engines - which trap destination for Cisco devices?

Wondering what the best practice is here folks - we've got multiple polling engines and as I understand it my network team tells me the SNMP trap destinations on the Cisco kit ideally needs to be entered as IP addresses.

What's the best way forward? Options as I see it:

- Send traps to DNS alias that round-robins to my polling engines: network team tell me that the IOS can work with that but it will hard code a host name to an IP. So it sticks to a single IP.

- Send to all polling engines: ok but, then we're generating unnecessary trap traffic and can NPM deduplicate the multiple copies of the same trap coming in?

We can't be the only folks in this position. What does everyone else do?

Find more posts tagged with

snmp_trap

Accepted answers

All comments

pacetti

qbarry,

You only need to send the trap to the polling engine that is actually polling the node in question. Check the Polling Details resource on the Node view for the node in question to see which of your polling engines is polling the viewed node.

HTH,

qbarry

Hmmm ok - that doesn't do much for redundancy. If one of my polling engines dies, I'd effectively lose all the traps from some of my devices in that case. There's got to be a better way?

Also wouldn't that mean I'd have to match up the polling engines to devices for trap destinations? We move devices around to different polling engines and so every time we do that we'd have to update the destination on the device? Sounds like a bunch of work!

Add into the mix then that we have the Failover Engine across two different data centers (and therefore two different subnets). If we failover, we'd have to update the trap destination(s) on potentailly thousands of devices. Got to be a better way!

JonnyG

qbarry

We are a couple of weeks of testing polling engines behind a content switch we don't believe this is supported but are going to give it a try for exactly the same reasons you state above. One we are done I will post back with our results.

JonnyG

mdriskell

This doesn't address your redundancy issue but to dispute Pacetti's post but we have 3 polling engines and all traps go to one....doesn't matter if the device is on that polling engine or not.

As long as the source IP matches the IP in NPM it is properly correlated to the correct NodeID.

pacetti

It's more flexible than I had understood. Thanks, mdriskell.

JonnyG

Hi All,

Just to confirm we have been able to get every thing configured behind a Cisco ACE appliance. The one caveat is that as the inbound protocols are all UDP Syslog UDP 514 SNMP Traps UDP 162 and Netflow UDP 2055. We had to be a little creative and ended up getting one of our devs to produce a webpage that allowed the ACE to hit a URL that confirmed that the windows service behind each of these port is at least up and running.

JonnyG