NPM - Add a Node without SNMPWALK

Question

I'm attempting to monitor the Checkpoint SNMP extension which runs on port 260. In order to add the node to NPM monitoring, it requires snmpwalk to return values, however, cpsnmp requires you to define a before it will respond (details below).

Is there a way to define a Node and OID to monitor without being able to walk the device?

THANKS.

---

I'd like to monitor the following:

[zawya001@netutil01 ~]$ snmpwalk -v 1 -c public 10.192.254.91:260 1.3.6.1.4.1.2620.1.1.25.3
SNMPv2-SMI::enterprises.2620.1.1.25.3.0 = INTEGER: 131572

However to add a node to NPM, it requires snmpwalk to return values...which fails without the firewall MIB-Branch:

[zawya001@netutil01 ~]$ snmpwalk -v 1 -c pubilc 10.192.254.91:260
[zawya001@netutil01 ~]$
[zawya001@netutil01 ~]$ snmpwalk -v 1 -c public 10.192.254.91:260 1 
SNMPv2-SMI::enterprises.2620.1.1.1.0 = STRING: "Installed"
SNMPv2-SMI::enterprises.2620.1.1.2.0 = STRING: "policy_infwcp10-cl.woc"
SNMPv2-SMI::enterprises.2620.1.1.3.0 = STRING: "Wed Dec 15 16:14:14 2010"
SNMPv2-SMI::enterprises.2620.1.1.4.0 = INTEGER: 826709229
SNMPv2-SMI::enterprises.2620.1.1.5.0 = INTEGER: 32

oiram · Answer

Thank you for explanation, now it makes more sense. Definitely validating against 260 will not bring expected results as on that port agent does not support MIB-2 thus NPM will not take is a valid. But you should be able to to save that node (with port 260) set for it. Though you may exclude it in some alerts based on SNMP results. Then you cna utilize UnDP against 1.3.6.1.4.1.2620.1.1.25.3

azawyrucha · Answer

Thanks for the suggestion, however...

The MIB-2 (1.3.6.1.2.1) tree falls under the standard default snmpd.conf which runs on the default 161 port. Checkpoint's secondary cpsnmp extension runs specifically on 260 which includes firewall statistics. acl permits, drops, etc.

Adding the device as a SNMP node (with modified 260 port) results in failure. My assumption is because the node doesn't respond to the snmp-read request without the fw-branch defined.

The first part of the OID [1.3.6.1.4.1.] can be polled from port 161, but the remaining 2620.1.1.25.3 must be done via 260. You cannot grab the entire sting from just one of the services.

Still stuck in quicksand...

oiram · Answer

I never had a chance to actually work with CheckPoint but conceptually agent can reside on any port and NPM allows you to configure that port per-node, with default 161

From your description I gather that you actually have to "walk" device, as a sort of initial process? Correct me if I'm wrong.

Now if you "walking" your device against ISO (.1) and getting such little set of OID(s) in return that means either device does not allow to read them or simply do not support them. Maybe is it just the way you posted them here for simplicity, as limited output? But definitely it does not show anything from MIB-2 (1.3.6.1.2.1) which is polled by Orion.

Now in order to poll 1.3.6.1.4.1.2620.1.1.25.3 you will have to have device added as SNMP node (with modified port) and then create UnDP for that OID.