Lab 09-05 · SNMP¶

MTCNA

Module 9 · RouterOS tools. Official course slides 366–367: SNMP (Simple Network Management Protocol) to monitor and manage devices, the versions RouterOS supports (v1, v2c, v3), and the Tools → SNMP window. The slides have no LAB block for SNMP; this lab turns them into one: you enable the agent and query it from a Linux laptop with snmpwalk.

A school IT department looks after 40 switches, 10 routers, 15 printers and a few servers. Nobody can log in to 65 devices every morning to ask "are you OK?". Instead, one monitoring program asks them all, every few minutes, the same questions: how long have you been up? how much traffic on each port? how hot is your CPU? Printers, routers, switches, NAS boxes from completely different brands all answer it, because they speak the same language: SNMP.

In this lab you switch on SNMP on r1, ask it questions from your laptop, and close the door that every router leaves open by default.

What you will learn

Explain what SNMP is, and the roles of manager and agent
Understand OIDs: the numbered addresses of each piece of information
Enable SNMP in IP → SNMP with contact and location
Create your own read-only community limited to the LAN and disable the default public one
Query r1 with snmpget and snmpwalk from pc1
Avoid the trap of leaving the well-known community public open to everybody

A library with numbered shelves¶

SNMP (Simple Network Management Protocol) lets a manager program read (and sometimes change) information on network devices. The device runs an agent that answers on UDP port 161.

The analogy for this lab: every device is a library where each piece of information sits on a numbered shelf. The shelf number is the OID (Object Identifier): a long list of numbers separated by dots, like 1.3.6.1.2.1.1.5.0. To borrow a book you show a library card: in SNMP v1 and v2c that card is the community, a word both sides know.

flowchart LR
    M["<b>Manager</b><br>pc1 with snmpwalk<br>the reader"]
    A["<b>Agent</b><br>r1, UDP 161<br>the librarian"]
    M -->|"GET 1.3.6.1.2.1.1.5.0<br>card: mtcna"| A
    A -->|"r1"| M

The shelves follow a world-wide tree, so the same number means the same thing on every brand:

OID	Name	What it holds
`1.3.6.1.2.1.1.3.0`	sysUpTime	Time since the device started
`1.3.6.1.2.1.1.5.0`	sysName	The device's name (r1's identity)
`1.3.6.1.2.1.1.6.0`	sysLocation	Where it is (you fill it in)
`1.3.6.1.2.1.2.2.1.2`	ifDescr	The list of interface names
`1.3.6.1.2.1.31.1.1.1.6`	ifHCInOctets	Bytes received on each interface
`1.3.6.1.4.1.14988`	(MikroTik)	Shelves only MikroTik devices have

1.3.6.1.4.1 is the corner where each company gets its own shelf. MikroTik's number is 14988.

Version	Card (security)	Use it?
v1	Community, sent as plain text	Only for very old devices
v2c	Community, sent as plain text; faster bulk reads	Fine inside a trusted LAN
v3	User with password and encryption	Yes, whenever data crosses untrusted networks

The community is a password that travels unencrypted

In v1 and v2c anyone who captures the traffic reads the community. And every router ships with the same one, public. Leaving public enabled is like a library card everybody already has.

Reading and writing

SNMP can also write (change settings). RouterOS supports write only for a few settings (the course: "available only for some configurations"). In this lab the community is read-only.

The scenario¶

flowchart LR
    INET["<b>internet</b><br>198.51.100.10"]
    CAP["<b>class-ap</b><br>10.0.0.1 · 198.51.100.1"]
    subgraph R1["r1 · your router (SNMP agent)"]
        WAN["ether2 (WAN)<br>10.0.0.x by DHCP"]
        BR["<b>bridge1</b><br>192.168.88.1/24<br>UDP 161"]
    end
    PC1["<b>pc1</b><br>SNMP manager<br>snmpget, snmpwalk"]
    INET ---|"198.51.100.0/24"| CAP
    CAP ---|"10.0.0.0/24"| WAN
    WAN --- BR
    BR ---|"ether3"| PC1

Node	Role	Address
`internet`	"The Internet"	`198.51.100.10`
`class-ap`	Class gateway: DHCP, DNS, NAT	`10.0.0.1/24`
`r1`	Your router: SNMP disabled (the RouterOS default), only the community `public`	WAN by DHCP, LAN `192.168.88.1/24`
`pc1`	The manager: has the `snmp` tools installed	DHCP from r1

Why ether2 and not ether1?

On a real hAP the Internet port is ether1. In the virtual lab ether1 is reserved for the lab itself (containerlab uses it to manage the router), so the Internet port is ether2 and the LAN ports start at ether3. Never touch ether1 in these labs.

Start the lab¶

Download the lab files and unzip them: 09-05-snmp.zip. Open a terminal inside the 09-05-snmp folder.

sudo containerlab deploy -t topology.clab.yml

Give RouterOS about two minutes to boot. Then open the router and the laptop:

ssh admin@clab-mtcna-09-05-r1                 # password: admin
docker exec -it clab-mtcna-09-05-pc1 bash

At any moment, CLAB_EXEC="docker exec" ./check.sh tells you what is already solved.

Step 1 · Knock on a closed door¶

On pc1, ask r1 for its name with the default community:

snmpget -v2c -c public 192.168.88.1 1.3.6.1.2.1.1.5.0

-v2c: use SNMP version 2c.
-c public: the community (the library card).
1.3.6.1.2.1.1.5.0: the OID of sysName.

Expected, after a few seconds: Timeout: No Response from 192.168.88.1. Nobody is at the desk.

On r1, see why. WinBox: IP → SNMP.

/snmp print
/snmp community print

Expected: enabled: no, and one community public with addresses ::/0 (everybody), read-access yes.

Done when you know the agent is off and which community exists.

Step 2 · Switch the agent on¶

WinBox: IP → SNMP, tick Enabled, Contact Info you@mtcna.lab, Location Classroom, table 1. Apply.

/snmp set enabled=yes contact="you@mtcna.lab" location="Classroom, table 1"

Now from pc1, read the whole system branch:

snmpwalk -v2c -c public 192.168.88.1 1.3.6.1.2.1.1

Expected (part):

iso.3.6.1.2.1.1.1.0 = STRING: "RouterOS CHR 7.23.8 (long-term)"
iso.3.6.1.2.1.1.4.0 = STRING: "you@mtcna.lab"
iso.3.6.1.2.1.1.5.0 = STRING: "r1"
iso.3.6.1.2.1.1.6.0 = STRING: "Classroom, table 1"

snmpget reads one shelf; snmpwalk reads a shelf and everything below it. pc1 shows numbers (iso.3.6...) instead of names because the name files (MIBs) are not installed; the numbers are what really travels.

Check yourself

You just read r1's name, version and location with the card public, which every router in the world has. Who else on the network could do the same?

Done when snmpwalk returns r1's name and location.

Step 3 · Your own card, LAN only¶

Create a community with a name only you know, allowed only from the LAN, and read-only.

WinBox: IP → SNMP → Communities → +: Name mtcna, Addresses 192.168.88.0/24, Read Access ticked, Write Access unticked.

/snmp community add name=mtcna addresses=192.168.88.0/24 read-access=yes write-access=no comment="read-only, LAN only"

Now disable public. It is the default community (flag *), so RouterOS does not let you delete it, but you can disable it:

/snmp community set [find name=public] disabled=yes
/snmp community print

Expected: public with flag X (disabled), and mtcna with 192.168.88.0/24.

From pc1, test both cards:

snmpget -v2c -c public -t 1 -r 0 192.168.88.1 1.3.6.1.2.1.1.5.0
snmpget -v2c -c mtcna 192.168.88.1 1.3.6.1.2.1.1.5.0

Expected: public → Timeout; mtcna → STRING: "r1".

Wrong card, no answer

An SNMP agent does not reply "wrong password". It just stays silent, so a wrong community and a dead device look the same: Timeout. Remember that when you troubleshoot.

Check yourself

A device at 10.0.0.50 knows the word mtcna. Can it read r1? Why?

Done when public times out and mtcna answers.

Step 4 · Ask useful questions¶

A monitoring program does not care about names: it wants counters. List the interfaces, then the bytes received on each one:

snmpwalk -v2c -c mtcna 192.168.88.1 1.3.6.1.2.1.2.2.1.2
snmpwalk -v2c -c mtcna 192.168.88.1 1.3.6.1.2.1.31.1.1.1.6

The last number of each line is the interface's index: ...2.3 = "ether2" and ...6.3 = Counter64: ... belong together. Run the second command twice, a few seconds apart, and the ether2 counter grows. A monitoring program does exactly this every few minutes and draws a graph from the difference.

How do you find the OID of something you see in RouterOS? Ask the router itself:

/interface print oid where name=ether2
/system resource print oid

Expected: every field with its OID next to it, for example bytes-in=.1.3.6.1.2.1.31.1.1.1.6.3.

Check yourself

Write the OID of uptime from /system resource print oid, and read it from pc1 with snmpget.

Done when you can read ether2's byte counter from pc1. Run CLAB_EXEC="docker exec" ./check.sh: it must end with RESULT: lab solved.

If something goes wrong¶

Symptom	Likely cause	Fix
`Timeout: No Response` with any community	SNMP is not enabled	`/snmp set enabled=yes`
`public` works but `mtcna` times out	Typo in the community, or pc1 is outside `addresses`	`/snmp community print`; pc1 must be in 192.168.88.0/24
`failure: can not remove default community`	You tried to delete `public`	Disable it instead: `set [find name=public] disabled=yes`
`snmpwalk: command not found`	You are on r1 or on your Ubuntu PC	Run it on pc1
Output shows numbers, not names	The MIB files are not installed on pc1	Normal; the numbers are the real OIDs

Clean up¶

sudo containerlab destroy -t topology.clab.yml --cleanup

Key takeaways¶

SNMP lets a manager read information from an agent on each device, over UDP 161.
Each value has an OID, a numbered address in a world-wide tree; MikroTik's own branch is 14988.
In v1/v2c the community is a shared word sent in clear text; v3 adds users and encryption.
Good practice: disable the default public community and use your own, read-only, limited by addresses.
/interface print oid and /system resource print oid show the OID of what you see in RouterOS.

Quick check¶

1. On which port and protocol does an SNMP agent answer queries?

UDP 161
TCP 80
TCP 8291
UDP 53

The agent listens on UDP 161. TCP 80 is the web server, 8291 is WinBox and UDP 53 is DNS.

2. What is an OID?

The numbered address of one piece of information, like 1.3.6.1.2.1.1.5.0
The password of an SNMP user
The MAC address of the SNMP agent
The name of the monitoring program

An OID (Object Identifier) is the shelf number in the SNMP tree. 1.3.6.1.2.1.1.5.0 is the device's name, sysName, on every brand.

3. Why should you disable the community 'public'?

It is the same well-known word on countless devices, so anyone can use it
It makes SNMP slower
It only works with SNMP v3
It gives write access to every setting

public is the default everywhere, and v1/v2c communities travel unencrypted. Leaving it on hands your device's information to anyone who can reach UDP 161.

4. You query r1 with a wrong community. What does snmpget show?

A timeout, the same as if the device were off
An error message saying "wrong community"
The answer, but marked as untrusted
A request to type the community again

The agent stays silent with a wrong community. That is why a typo and a dead device both look like Timeout: No Response.

5. What does the community setting addresses=192.168.88.0/24 do?

Only managers in that network may use this community
The router answers SNMP only on the interface with that network
It gives SNMP addresses to the LAN by DHCP
It limits SNMP to 24 queries per minute

addresses is a list of allowed managers. A request with the right community from another network is still ignored.

6. A school wants one program to monitor 40 switches of three different brands over its own LAN. Pick the two good choices.

Use SNMP, because all brands speak the same protocol and OIDs
Use a private read-only community, or SNMP v3 where possible
Log in by SSH to each switch every morning
Keep the community public so the program finds every switch

SNMP's standard OIDs mean the same on every brand, so one manager can read them all. Security means a private read-only community (or v3), never public.

Next: a monitoring program with a map, alerts and SNMP built in, made by MikroTik itself: The Dude.