SNMP configuration

Trellix appliances send Simple Network Management Protocol (SNMP) data to communicate abnormal conditions to SNMP managers, administrative computers that monitor and control SNMP data across a network. The NDR Series appliance supports both SNMPv2 and SNMPv3 with Enterprise-Specific MIB and trap support. SNMPv3 provides greater data security over SNMPv2 because it adds user authentication and payload encryption to ensure only authorized users can perform read and write operations. SNMPv3 also allows you to create multiple user accounts with assigned SNMP data access rights.

Note
Trellix recommends enabling SNMPv3 to send SNMP data.

NDR SNMP data includes the following:

Information that is retrieved (polled) by the SNMP manager. This information is sent in response to requests the SNMP manager sends to the NDR appliance.
Events, known as traps, that are sent (pushed) by the NDR appliance to the SNMP manager. Traps typically report alarm conditions such as a disk failure or excessive temperature. They are unsolicited; that is, they are not sent in response to requests from the SNMP manager.

Prerequisites

Admin access

Configuring SNMP data

To configure SNMPv3 data:

Log in to the NDR as npadmin using the NDR IP address or FQDN. For example:
$ ssh npadmin@10.1.0.1
or
$ ssh npadmin@exampleFQDN
Enter privileged mode:
npadmin@ia> enable
Enter the npadmin password. The password can be 5 to 24 characters long.
[sudo] password for npadmin: <password>
Enter configuration mode:
npadmin@ia# configure system
Enter the SNMP menu:
npadmin@hostname(config) # snmp
You will see the following:
1: SNMP enabled = False
2: SNMP community string = public
3: SNMPv3 users =
4: SNMP system contact =
5: SNMP system location =
6: SNMP system name =
7: SNMP traps enabled = False
8: SNMP trap target(s) =
9: SNMP trap string =
10: Set SNMP traps
Select 3 to enable SNMPv3:
You will see the following:
a: Add
d: Delete
e: Edit
Press ENTER to go back to the main menu using the index letter:
Select a to add a user:
Username:
Note
Username length must be greater than 4 characters and less than 32.
Enable write access:
Enable write access [y/n]:
Note
User are granted read access by default therefore, any user with write access also has read access.
Enter and confirm a user password:
Note
Passwords must be not contain any numeric or special characters.
You will see the following:
*** Your passphrase will NOT echo on screen! ***
Input user passphrase [in alphabets only]:
Click Enter to go back to the main menu.

To configure SNMPv2 data:

Log in to the NDR as npadmin using the NDR IP address or FQDN. For example:
$ ssh npadmin@10.1.0.1
or
$ ssh npadmin@exampleFQDN
Enter privileged mode:
npadmin@ia> enable
Enter the npadmin password. The password can be 5 to 24 characters long.
[sudo] password for npadmin: <password>
Enter configuration mode:
npadmin@ia# configure system
Enter the SNMP menu:
npadmin@hostname(config) # snmp
You will see the following:
1: SNMP enabled = False
2: SNMP community string = public
3: SNMP system contact =
4: SNMP system location =
5: SNMP system name =
6: SNMP traps enabled = False
7: SNMP trap target(s) =
8: SNMP trap string =
9: Set SNMP traps
Select 1 to enable SNMP
Select y to enable SNMP:
Enable snmp [y/n]: y
Type 2 to change the SNMP community string. Your community string serves like a password. The default community string is public.
Community string:
Note
It is a security risk to leave public as the default community string
Type 3 to enter the contact name of the administrator responsible for the health of the appliance.
Select 4 to enter the name of the physical location of the appliance.
Select 5 to enter the appliance name.

SNMP Traps

The NDR appliances supports the following SNMP traps:

SNMP Traps	Description
Process down	A monitored process is down.
Process up	All processes are running in normal state.
Health status yellow	Cluster is in a degraded state.
Health status red	Cluster is in a failed state.
System temperature	Cluster is above the temperature threshold. The default temperature is 75° Celsius.
System 1 minute average load	Load exceeds 60. Trellix recommends maintaining a system load of 20 or below. The default threshold is 60.
System 5 minutes average load	Load exceeds 40. Trellix recommends maintaining a system load of 20 or below. The default threshold is 40.
System 15 minutes average load	Load exceeds 40. Trellix recommends maintaining a system load of 20 or below. The default threshold is 40.
Tunnel down	A PX connection is down.
Tunnel up	All PX connections are up.
RAID down	A logical device on the NDR is degraded.
Disk usage percentage	The disk usage exceeds a threshold of 85 percent. The default threshold is 85%.

To configure SNMP traps

From the SNMP menu, select option 6 to enable SNMP traps.
Select y to enable SNMP traps:
Enable traps [y/n]
Select 7 to set the Trap target. Specify targets as host1:port1 host2:port2. Be sure hosts are separated with a space. Note that ports are optional.
SNMP trap target(s):
Select 8 to set the Trap string.
Trap string:
Select 9 to set the SNMP traps:
You will see the following:
a: Process down enabled = False
b: Process restarted enabled = False
c: Elasticsearch yellow enabled = False
d: Elasticsearch red enabled = False
e: Tunnel down enabled = False
f: Tunnel up enabled = False
g: RAID failure enabled = False
h: Disk usage percentage enabled = False
i: 1 minute average load enabled = False
j: 5 minute average load enabled = False
k: 15 minute average load enabled = False
l: Temperature enabled = False
Important
Each SNMP trap is disabled by default.
Select Q to save.

Retrieving SNMP Data Using MIBs

A Management Information Base (MIB) is a text file written in a specific format in which all of the manageable features of a device are arranged in a tree. Each branch of the tree contains a number and a name, and the complete path from the top of the tree down to the point of interest forms the Object Identifier, or OID. The OID is a string of values separated by periods, such as .1.3.6.1.2.1.1.3.0.

You can send requests for data on an object using the OID, but it can be simpler to use the symbolic name for the object instead. A MIB allows SNMP tools to translate the symbolic names into OIDs before sending the requests to the managed device.

The table below lists the monitoring and status OIDs:

OID	Type	Description
.1.3.6.1.4.1.38885.62.1.1.1.0	String	Down process list
.1.3.6.1.4.1.38885.62.1.1.3.x.2.0 (x: 1 ~ 64)	Integer	Status of the monitored process (0: running, 1: stopped)
.1.3.6.1.4.1.38885.62.1.5.2.0	String	Health status value ('red': 0, 'yellow': 1, 'green': 2)
1.3.6.1.4.1.38885.62.1.9.2.0	Integer	System 1 minute average load
1.3.6.1.4.1.38885.62.1.9.3.0	Integer	System 5 minutes average load
.1.3.6.1.4.1.38885.62.1.9.4.0	Integer	System 15 minutes average load
.1.3.6.1.4.1.38885.62.1.10.1.0	String	Down tunnel list
.1.3.6.1.4.1.38885.62.1.10.2.0	Integer	Down tunnel count
.1.3.6.1.4.1.38885.62.1.11.3.0	Integer	Disk usage percentage
1.3.6.1.4.1.38885.62.1.9.1.0	Integer	System temperature
1.3.6.1.4.1.38885.62.1.11.11.0	Integer	RAID controller failed stripes (0 or 1)

Accessing MIBs

The NDR MIB is available on the appliance at /usr/share/snmp/mibs/NDR-MIB.txt. A typical SNMP browser can retrieve the values the appliance supports, and then display them in a hierarchy so you can navigate to the value you need to include in the request.

To access MIBs:

Log into the CLI on the NDR.
Enter privileged mode:
hostname> enable
Enter the password.
[sudo] password for npadmin: <password>
Enter shell:
hostname# shell
The MIBs for the NDR specific traps are located in /usr/share/snmp/mibs on the NDR Series appliance.
Copy the MIB to /home/npscp and pull the MIB from the NDR using an SCP client, or SCP the MIB directly to your SNMP manager.
In your monitoring system, upload them or copy them to the MIB file directory.

Requesting SNMP Information

There are two ways to retrieve SNMP information:

The snmpget command retrieves the value of a specific object.
The snmpwalk command walks through the object hierarchy and automatically retrieves the object values for the subtree or node that you specified in your walk command.

SNMP commands are entered from the SNMP manager application. See examples of basic commands that retrieve SNMP information below.

Example SNMP v2c commands:

SNMP v2c Command	Description	Example
snmpget	Walks all NDR SNMP entries.	`snmpwalk -v 2c -c public localhost iaAgentModules`
snmpwalk	Retrieves the down processes list.	`snmpget -v 2c -c public localhost .1.3.6.1.4.1.38885.62.1.1.1.0`