SNMP Server#

Management → SSSNMP Servers

The Simple Network Management Protocol (SNMP) is used to monitor and manage network elements.

Over the decades, multiple versions of SNMP have been created:

• SNMPv1 (RFC 1157) is the original version and has largely been superseded by later versions.
• SNMPv2c (RFC 1901) is the community-based variant of SNMPv2. It adds protocol operations and operational improvements but retains community-based security.
• SNMPv3 (RFC 3414) adds user-based authentication and privacy features.

The SNMPServer resource currently supports SNMPv2c and SNMPv3.

SNMP communities#

When SNMPv2c is selected, access control happens through SNMP communities, which are shared secret strings used to determine which requests the client can make. If the client uses a community that is not known by the SNMP server, the request is rejected.

Access permissions are associated with the community and determine which object identifiers (OIDs) requests using that community can access.

SNMP users#

When SNMPv3 is selected, a list of NodeUser resources that may access the SNMP server must be defined. These users can be selected individually or through label selectors. At least one NodeGroup to which each NodeUser belongs must have the SNMP service enabled.

Access permissions are associated with the users and determine which object identifiers (OIDs) each user can access.

Permissions#

A community string or user credentials can grant the following levels of access:

• Read for read-only access to non-security OIDs
• ReadWrite for read and write access to non-security OIDs
• ReadWriteAll for read and write access to all OIDs, including security OIDs

OS-specific implementation notes#

On SR Linux, SNMP write requests are not supported. The accessPermission property is ignored.

Refer to the SR OS documentation to see which object IDs are excluded by the no-security view, which is used when the access permission is Read or ReadWrite. For ReadWriteAll, the iso view is used. Custom views are not currently supported.

Dependencies#

Each SNMPServer resource targets either a ManagementRouter, a DefaultRouter, or a Router. While only one of the three is required, all three are listed as dependencies.

ManagementRouter#

If the SNMPServer is reachable through a ManagementRouter, the resource referenced by the router property must exist.

DefaultRouter#

If the SNMPServer is reachable through a DefaultRouter, the resource referenced by the router property must exist.

Label selectors may be used to select multiple DefaultRouters.

Router#

If the SNMPServer is reachable through a Router, the resource referenced by the router property must exist.

Referenced resources#

The SNMPServer does not reference any other EDA resources.

Examples#

apiVersion: management.eda.nokia.com/v1
kind: SNMPServer
metadata:
  name: mgmt-snmp-server
  namespace: eda
spec:
  accessPermission: ReadWriteAll
  enabled: true
  nodeUsers:
    - snmpuser
  protocol: Both
  router: init-base-mgmt-router
  routerKind: ManagementRouter
  securityLevel: AuthPriv
  streaming: Disabled
  version: SNMPv3
  AuthenticationProtocol: SHA2-256
  privacyProtocol: CFB128-AES-256

cat << 'EOF' | kubectl apply -f -
apiVersion: management.eda.nokia.com/v1
kind: SNMPServer
metadata:
  name: mgmt-snmp-server
  namespace: eda
spec:
  accessPermission: ReadWriteAll
  enabled: true
  nodeUsers:
    - snmpuser
  protocol: Both
  router: init-base-mgmt-router
  routerKind: ManagementRouter
  securityLevel: AuthPriv
  streaming: Disabled
  version: SNMPv3
  AuthenticationProtocol: SHA2-256
  privacyProtocol: CFB128-AES-256
EOF

Custom Resource Definition#

To browse the Custom Resource Definition go to crd.eda.dev.