syslog/snmp entries from srx345 juniper to solarwinds

Question

I have configured the srx345 router to stream snmp/syslog entries to the npm solarwinds server, I have juniper support and did pcap and can see entries being sent to the server. I've configured internal application untangle to forward those entries to the npm server.  I've used wireshark to capture entries leaving the server.  Yet noptingh shows up in syslog or snmp test fail snmp v2. any help would be greatly appreciated.  Jim

superfly · Answer

I assume you've added the srx345 into NPM.

Is there a firewall in between the srx345 and Solarwinds? Or have you allowed this traffic on the srx345?

sum_giais · Answer

Hi Jim,

Have you configured the snmp-server on the srx345 itself? Configuring SNMP traps and syslog on the srx345 to be sent to the Orion server, or for that matter forwarded to the Orion server is not the same as configuring an snmp-server on it.

This is something that gets commonly misunderstood about the SNMP protocol and how it actually works. There's two parts of SNMP.

SNMP Server:
This is what typically gets configured on a device where it is simply starting a daemon or service on udp port 161 as the default. This service needs at the very least in v1 and v2 a community string, by default 'public' in most cases. You can then query this service via SNMP as a client by providing the community string. That is what Orion is doing when you test SNMP credentials against a device to add it in as a node. Orion is acting as a client sending queries to the snmp-server over udp port 161, and the device responds with the data requested.

SNMP Traps:
An snmp-trap is generated by the device and sent to udp port 162 by default. It also gets assigned a community string and again default is usually 'public', but on top of that needs a host / ip to send it to. These are looked at as event driven traffic however, and in some ways is similar to syslog as it gets generated by the device on demand. Orion ingests this traffic as a server listening on udp port 162.

Both the snmp-server and snmp-traps are standardized and use what are called MIBs to frame all the data into what are called OID's - Object Identifiers. There are multiple versions of snmp... snmpv1, snmpv2c, and snmpv3.

Snmpv3 is the most secure but all of them have there pitfalls and SNMP as a whole is an archaic protocol that surprisingly is still around! Just my 2 cents lol. There is a lot more you can do with SNMP but those are the basics.

Some points of reference:
https://en.m.wikipedia.org/wiki/Simple_Network_Management_Protocol

Sorry if you knew this already but hopefully this is helpful even in the slightest... Good luck!!