Retrieving SNMP data

This section describes how to retrieve SNMP information from the NX appliance.

A Management Information Base (MIB) is a text file written in a specific format in which all of the manageable features of a device are arranged in a tree. Each branch of the tree contains a number and a name, and the complete path from the top of the tree down to the point of interest forms the Object Identifier, or OID. The OID is a string of values separated by periods, such as .1.3.6.1.2.1.1.3.0.

You can send requests for data on an object using the OID, but it can be simpler to use the symbolic name for the object instead. A MIB allows SNMP tools to translate the symbolic names into OIDs before sending the requests to the managed device. Symbolic names for objects in the Trellix MIB include feSerialNumber.0, feHardwareModel.0, feProductLicenseActive0, feFanIsHealthy.1, and so on.

The Trellix MIB, named FE-FIREEYE-MIB, needs to be downloaded from the NX appliance to the SNMP manager so it can be loaded into an SNMP browser or other tool. A typical SNMP browser can retrieve the values the appliance supports, and then display them in a hierarchy so you can navigate to the value you need to include in the request.

This section contains the following topics:

Providing access to SNMP data

To allow access to SNMP v3 data, configure a username and password.

Prerequisites

Operator or Admin access

To enable access to SNMP data:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

Verify that SNMP is enabled:
```
hostname (config) # show snmp
```
If the output shows SNMP enabled: no, enter the snmp-server enable command.

SNMP v3: Specify the SNMP user and password:

hostname (config) # snmp-server user <username> v3 enable
hostname (config) # snmp-server user <username> v3 auth sha <password>

Save your changes:
```
hostname (config) # write memory
```

Downloading the MIB

You can download the MIB from the Web UI or from the command prompt.

Prerequisites

Analyst, Operator, or Admin access

Downloading the MIB using the Web UI

Use the Notification Settings page to download the MIB.

To download the MIB:

Click the Settings tab.
Click Notifications on the sidebar.
Click the SNMP tab.
In the Define protocol settings section, click Download.

Downloading the MIB using the command prompt

This section describes how to download the FE-FIREEYE-MIB to SNMP managers that run on Microsoft Windows, Linux, and Apple devices. The MIB file is retrieved using a program that connects using port 22, which is normally used for protocols such as SSH, SCP, and PSCP. Because file-level access is denied by policy, the direct path to the MIB file needs to be specified.

To download the MIB to Windows devices:

Download the pscp.exe tool (available from PuTTY download page).
Navigate to a command prompt window.
Change to the directory in which you downloaded the pscp.exe tool:
```
cd Downloads
```

Copy the MIB file from the appliance:

pscp.exe -r -scp admin@<appliance><applianceIPAddress>:/usr/share/snmp/mibs \Temp\mibs\

When prompted for the password, enter admin.
The files are copied to the \Temp\mibs directory on the Windows device.
Change to the mibs directory:
```
cd C:\Temp\mib
```
Load the MIB into an SNMP browser or tool, or open the MIB file:
```
vi FE-FIREEYE-MIB.txt
```

To download the MIB to Linux devices:

Copy the MIB file from the appliance using the OpenSSH client:

scp -r admin@<appliance><applianceIPAddress>:/usr/share/snmp/mibs /usr/<userDirectoryName>

When prompted for the password, type admin.
The files are copied to the mibs directory that resides in the /usr/<userDirectoryName> directory.
Change to the mibs directory:
```
cd mibs
```
Load the MIB into an SNMP browser or tool, or open the MIB file:
```
vi FE-FIREEYE-MIB.txt
```

To download the MIB to Apple devices:

Navigate to the terminal emulator.

Copy the MIB files from the appliance:

scp -r admin@<applianceIPAddress>:/usr/share/snmp/mibs ~/

When prompted for the password, type admin.
The files are copied to the mibs directory that resides in the user directory.
Load the MIB into an SNMP browser or tool, or open the MIB file:
```
vi FE-FIREEYE-MIB.txt
```

Sending requests for SNMP information

This topic describes two ways to retrieve SNMP information.

The snmpget command retrieves the value of a specific object.
The snmpwalk command walks through the object hierarchy, automatically retrieving the values of objects for the subtree or node that you specified.

Examples of basic commands that retrieve SNMP data follow. The commands are entered from the SNMP manager application. The IP address in the commands is the appliance IP address.

SNMP v3 commands:

snmpmgr # snmpget  -m +FE-FIREEYE-MIB -v 3 -u myname -a MD5 -A mypassword -l authNoPriv 172.0.0.0 feTemperatureValue.0

snmpmgr # snmpwalk  -m +FE-FIREEYE-MIB -v 3 -u myname -a MD5 -A mypassword -l authNoPriv 172.0.0.0 enterprises.25597

SNMP v2c commands:

snmpmgr # snmpget  -m +FE-FIREEYE-MIB -v 2c -c public 172.0.0.0 feSupportLicenseActive.0

snmpmgr # snmpwalk -m +FE-FIREEYE-MIB -v 2c -c public 172.0.0.0 fireeye

snmpmgr # snmpwalk -v 2c -c public 172.0.0.0 enterprises.25597

To retrieve license expiration dates formatted in a table, use a command similar to the following (different commands are required by different SNMP manager applications):

snmpmgr # snmptable -c public -Of -v 2c localhost feLicenseFeatureTable

Check the number of days in the rightmost column. If the value is less than 30, contact your system administrator.