SNMP

Simple network management protocol (SNMP) provides the ability to monitor and communicate status information between a variety of hosts.

  • Before installing SNMP, see Checklist: Implementing the SNMP service.
  • To find features that have been moved in the Microsoft® Windows® Server 2003 family, see New ways to do familiar tasks.
  • For tips about using SNMP, see Best practices.
  • For help with specific tasks, see How To...
  • For general background information, see Concepts.
  • For problem-solving instructions, see Troubleshooting.


Checklist: Implementing the SNMP service

Step | Reference
Obtain, install, and configure SNMP management software. | The SNMP service
Gather information required to implement SNMP on your network. Requirements include contact persons (administrator), physical computer location, configured SNMP community names, and IP or IPX addresses, or computer names of SNMP management systems on your network. | Using SNMP
Install SNMP on this computer. | To install the SNMP service
Configure SNMP agent properties. | To configure agent properties
If you have an additional TCP/IP service in your network, such as a bridge or router, you should consult RFC 1213 for additional configuration information before proceeding. | "Simple Network Management Protocol" at the Microsoft Windows Resource Kits Web site (http://www.microsoft.com/)
Configure trap destinations. | To configure traps
Configure SNMP security properties. | To configure SNMP security properties

Note

  • XOX


New ways to do familiar tasks

The following table lists common tasks for configuring Simple Network Management Protocol (SNMP). The user interface for performing these tasks is different in this version of Windows from the way it was in Windows NT version 4.0.

Note

  • XOX
If you want to | In Windows NT 4.0 use | In this version of Windows use
Install the SNMP service. | The SNMP Service option in Windows NT TCP/IP Installation Options. | Windows Components wizard. For more information, see Install the SNMP service.
Configure the SNMP agent. | Control Panel, Network, Services tab. | Services in the Computer Management console. For more information, see Configure agent properties.
Configure SNMP traps. | Control Panel, Network, Services tab. | Services in the Computer Management console. For more information, see Configure traps.
Configure SNMP security. | Control Panel, Network, Services tab. | Services in the Computer Management console. For more information, see Configure SNMP security properties.


Best practices

Update settings regularly.

  • Make sure that you monitor and update the host name settings on an ongoing basis. This will help ensure timely detection of any unauthorized access.

Allow hosts to accept packets only from specific hosts.

  • When you configure security options, do not click Accept packets from any host.

Configure authentication traps.

  • Take advantage of SNMP security checking by configuring authentication traps on all SNMP agents.

Verify proper functioning of service-specific components.

  • If you will be monitoring service-specific components, such as Dynamic Host Configuration Protocol (DHCP) or Windows Internet Name Service (WINS), verify that these services have been successfully installed and configured.

Use IPSec to secure SNMP messages.

  • Reduce the risk of internal attacks by configuring the SNMP agent systems to reject request messages from unauthorized management systems. For security purposes, use Internet Protocol security (IPSec) to secure SNMP messages by creating filter specifications in the appropriate IP filter list between SNMP management systems and agents. For more information on how to do this, see Securing SNMP messages with IPSec.

Remember that SNMP is an insecure protocol.

  • If you decide to use SNMP to manage networks, remember that SNMP is an insecure protocol whose effectiveness depends solely on how you implement it.

Use the concept of functional organization for SNMP communities.

  • Try to organize SNMP communities by functional organization. For more information about SNMP, see "Simple Network Management Protocol" at the Microsoft Windows Resource Kits Web site.(http://www.microsoft.com/)


How to...

  • Install the SNMP service
  • Configure agent properties
  • Configure traps
  • Configure SNMP security properties
  • Start or stop the SNMP service
  • Configure event to trap translator


Install the SNMP service

Microsoft Windows graphic

To install the SNMP service

  1. Open Windows Components wizard.
  2. In Components, click Management and Monitoring Tools (but do not select or clear its check box), and then click Details.
  3. Select the Simple Network Management Protocol check box, and click OK.
  4. Click Next.

Notes

  • XOX
  • XOX
  • XOX
  • SNMP starts automatically after installation.

Related Topics


Configure agent properties

Microsoft Windows graphic

To configure agent properties

  1. Open Computer Management.
  2. In the console tree, click Services.

    Where?

    • Services and Applications
    • Services
  3. In the details pane, click SNMP Service.
  4. On the Action menu, click Properties.
  5. On the Agent tab, in Contact, type the name of the user or administrator for this computer.
  6. In Location, type the physical location of the computer or the contact.
  7. Under Service, select the appropriate check boxes for this computer, and then click OK.

Notes

  • XOX
  • XOX
  • If you change Contact or Location SNMP settings, your changes take effect within a few minutes.

Related Topics


Configure traps

Microsoft Windows graphic

To configure traps

  1. Open Computer Management.
  2. In the console tree, click Services.

    Where?

    • Services and Applications
    • Services
  3. In the details pane, click SNMP Service.
  4. On the Action menu, click Properties.
  5. On the Traps tab, under Community name, type the case-sensitive community name to which this computer will send trap messages, and then click Add to list.
  6. In Trap destinations, click Add.
  7. In Host name, IP or IPX address, type information for the host, and click Add.
  8. Repeat steps 5 through 7 until you have added all the communities and trap destinations you want.

Notes

  • XOX
  • XOX
  • If you change existing SNMP settings, your changes take effect immediately. The SNMP service does not need to be restarted for your settings to take effect.
  • XOX

Related Topics


Configure SNMP security properties

Microsoft Windows graphic

To configure SNMP security properties

  1. Open Computer Management.
  2. In the console tree, click Services.

    Where?

    • Services and Applications
    • Services
  3. In the details pane, click SNMP Service.
  4. On the Action menu, click Properties.
  5. On the Security tab, select Send authentication trap if you want a trap message sent whenever authentication fails.
  6. Under Accepted community names, click Add.
  7. Under Community Rights, select a permission level for this host to process SNMP requests from the selected community.
  8. In Community Name, type a case-sensitive community name, and then click Add.
  9. Specify whether or not to accept SNMP packets from a host:
    • To accept SNMP requests from any host on the network, regardless of identity, click Accept SNMP packets from any host.
    • To limit acceptance of SNMP packets, click Accept SNMP packets from these hosts, click Add, type the appropriate host name, IP or IPX address, and then click Add again.

Important

  • By default, SNMP does not respond to any community names presented.

Notes

  • XOX
  • XOX
  • You can add additional community and host names as necessary.
  • You can make changes to an entry by clicking the entry, and then clicking Edit. You can delete a selected entry by clicking Remove.
  • If you change existing SNMP settings, your changes take effect immediately. The SNMP service does not need to be restarted for your settings to take effect.
  • XOX

Related Topics


Start or stop the SNMP service

Microsoft Windows graphic

To start or stop the SNMP service

  1. Open Computer Management.
  2. In the console tree, click Services.

    Where?

    • Services and Applications
    • Services
  3. In the details pane, click SNMP Service.
  4. On the Action menu, click Start, Stop, or Restart.

Notes

  • XOX
  • XOX
  • If you add new extensions to SNMP, you do not need to restart the SNMP service for your changes to take effect.

Related Topics


Configure event to trap translator

Microsoft Windows graphic

To configure event to trap translator

  1. Open Command Prompt.
  2. At Command Prompt, type evntcmd /? for syntax and options for using the evntcmd command.

Notes

  • XOX
  • XOX

Related Topics


Concepts

This section covers:

  • SNMP Overview
  • Understanding SNMP
  • Using SNMP


SNMP overview

  • SNMP defined
  • The SNMP service


SNMP defined

The Simple Network Management Protocol (SNMP) is a network management standard widely used in TCP/IP networks.

SNMP provides a method of managing network hosts such as workstation or server computers, routers, bridges, and hubs from a centrally-located computer running network management software. SNMP performs management services by using a distributed architecture of management systems and agents.

Because network management is critical for both auditing and resource management, SNMP can be used to:

  • Configure remote devices. Configuration information can be sent to each networked host from the management system.
  • Monitor network performance. You can track the speed of processing and network throughput, and collect information about the success of data transmissions.
  • Detect network faults or inappropriate access. You can configure trigger alarms on network devices when certain events occur. When an alarm is triggered, the device forwards an event message to the management system. Common types of alarms include a device being shut down and restarted, a link failure being detected on a router, and inappropriate access.
  • Audit network usage. You can monitor both overall network usage to identify user or group access, and types of usage for network devices and services.


The SNMP service

The simple network management protocol (SNMP) service supports computers running TCP/IP and IPX protocols. It is an optional service that can be installed after the TCP/IP protocol has been successfully configured.

The SNMP service provides an SNMP agent that allows remote, centralized management of computers running:

  • XOX
  • Microsoft Windows 2000
  • Microsoft Windows Server 2003 family

The SNMP agent also allows management of the following services:

  • XOX or the Windows Server 2003 family and Microsoft Windows 2000-based WINS
  • XOX or the Windows Server 2003 family and Windows 2000-based DHCP
  • XOX or the Windows Server 2003 family and Windows 2000-based Internet Information Services
  • Microsoft LAN Manager

To access the information that the SNMP agent service provides, you need at least one SNMP management system software application. The SNMP service supports but does not currently include SNMP management software. SNMP management software must be running on the host which acts as the management system. For more information about SNMP management software and applications, see "Simple Network Management Protocol" at the Microsoft Windows Resource Kits Web site.(http://www.microsoft.com/)

Note

  • The IPX/SPX protocol is not available on Microsoft Windows XP 64-Bit Edition and the 64-bit versions of the Windows Server 2003 family.


Understanding SNMP

  • SNMP management systems and agents
  • SNMP messages


SNMP management systems and agents

Using SNMP requires two components:

  • An SNMP management system.

    The management system, also called management console, sends information and update requests to an SNMP agent. Any computer running SNMP management software is an SNMP management system. The management software application does not need to run on the same host as the SNMP agent.

    The SNMP management system requests information from a managed computer, called an SNMP agent, such as the amount of hard disk space available or the number of active sessions. If the management system has been granted write access to an agent, that management system can also initiate a change to the agent's configuration.

  • An SNMP agent.

    • The SNMP agent responds to management system requests for information. Any computer running SNMP agent software is an SNMP agent. The SNMP service, which is agent software, responds to information requests from one or multiple management systems. The SNMP service can be configured to determine which statistics are tracked and which management systems are authorized to request information.

    In general, agents do not originate messages, but only respond to them. A trap message is the only agent-initiated SNMP communication, and it enhances security. A trap is an alarm-triggering event, such as a system reboot or illegal access, on an agent.

    Management hosts and agents belong to an SNMP community, which is a collection of hosts grouped together for administrative purposes. Defining communities provides security by allowing only management systems and agents within the same community to communicate.


SNMP messages

When simple network management protocol (SNMP) management programs send requests to a network device, the agent software on that device receives the requests and retrieves information from MIBs. The agent then sends the requested information back to the initiating SNMP management program. To perform these tasks, the agent uses the following message types:

SNMP Message | Description
Get | The basic SNMP request message. Sent by an SNMP management system, it requests information about a single MIB entry on an SNMP agent. For example, the amount of free drive space.
Get-next | An extended type of request message that can be used to browse the entire tree of management objects. When processing a Get-next request for a particular object, the agent returns the identity and value of the object which logically follows the object from the request. The Get-next request is useful for dynamic tables, such as an internal IP route table.
Set | If write access is permitted, this message can be used to send and assign an updated MIB value to the agent.
Getbulk | Requests that the data transferred by the host agent be as large as possible within given restraints of message size. This minimizes the number of protocol exchanges required to retrieve a large amount of management information. The maximum message size should not be larger than the path maximum transmission unit (MTU), the largest frame size allowed for a single frame on your network, or fragmentation can occur.
Trap | An unsolicited message sent by an SNMP agent to an SNMP management system when the agent detects that a certain type of event has occurred locally on the managed host. The SNMP management console that receives a trap message is known as a trap destination. For example, a trap message might be sent on a system restart event.

Four of these message types are simple request-reply protocols where SNMP uses User Datagram Protocol (UDP). This means that a request from the management system might not arrive at the agent, and the agent's reply might not make it back to the management system. Because SNMP is a connectionless network protocol, SNMP messages are not guaranteed to arrive at their destinations.

You can use Internet Protocol security (IPSec) to secure traffic between SNMP management systems and agents. For more information, see Securing SNMP messages with IPSec.


Using SNMP

  • Defining communities
  • Agent properties
  • Trap properties
  • SNMP security properties
  • Securing SNMP messages with IPSec
  • SNMP service properties
  • Managing SNMP from the command line


Defining communities

You can assign groups of hosts to Simple Network Management Protocol (SNMP) communities for limited security checking of agents and management systems or for administrative purposes. Communities are identified by community names that you assign. A host can belong to multiple communities at the same time, but an agent does not accept a request from a management system outside its list of acceptable community names.

For more information, see Best practices.

Define communities logically to take advantage of the basic authentication service provided by SNMP. In the following example, there are two communities: Public 1 and Public 2.

Communities
  • Agent 1 can send traps to Manager 2 and respond to requests from Manager 2 because they are both members of the Public 2 community.
  • Agents 2-4 can send traps to Manager 1 and respond to requests from Manager 1 because they are all members, by default, of the Public 1 community.

Important

  • Community names are sent across the network as plaintext. Because attackers can read plaintext with network analysis software, sending SNMP community names across the network represents a potential security risk. You can help protect SNMP messages by configuring Internet Protocol security (IPSec). For more information about configuring SNMP for IPSec, see Securing SNMP messages with IPSec.

Notes

  • There is no relationship between community names and domain or workgroup names. Community names represent a shared password for groups of network hosts, and should be selected and changed as you would change any password.
  • Use community names primarily as an element for organization, not security.
  • You should not create a community that is named Public and grant it read access. You should also specify hosts from which packets can be accepted, rather than clicking Accept packets from any host.


Agent properties

The simple network management protocol (SNMP) agent provides the related management system with information on activities that occur at the Internet Protocol (IP) network layer.

The SNMP service sends MIB information in response to an SNMP request or in an SNMP trap message.

You can configure the following agent properties by using the Agent tab on the SNMP Service Properties dialog box:

Agent Service | Select if this computer:
Physical | Manages physical devices, such as a hard disk partition.
Applications | Uses any applications that send data using the TCP/IP protocol suite. This service should always be enabled.
Datalink and Subnet | Manages a bridge.
Internet | Is an IP gateway (router).
End-to-end | Is an IP host. This service should always be enabled.

You can also configure agent properties such as:

  • The location of the contact person.
  • The name of the person to contact, such as the network administrator.

For more information on how to configure SNMP agent properties, see To configure agent properties.


Trap properties

The SNMP service, when configured for an agent, generates trap messages if any specific events occur. These messages are sent to a trap destination. For example, an agent can be configured to initiate an authentication trap if a request for information is sent by an unrecognized management system.

Trap destinations consist of the computer name or the IP or IPX address of the management system. The trap destination must be a network-enabled host that is running SNMP management software. Trap destinations can be configured by a user, but the events (such as a system reboot) that can generate a trap message are internally defined by the SNMP agent.

XOX

You can configure trap destinations by using the Traps tab in SNMP Service Properties.

For more information on how to configure SNMP traps, see To configure traps.


SNMP security properties

Simple network management protocol (SNMP) provides security through the use of authentication traps and community names. In addition, you can restrict SNMP communications for the agent, allowing it to communicate with only a specified list of SNMP management systems. Because the SNMP protocol provides minimal security, you should use SNMP only on trusted networks.

You can configure certain features of SNMP security on the Security tab in the SNMP Service Properties dialog box. These features provide a minimal level of security to your network, and you should use them in conjunction with other stronger methods of secure network management.

The following options can be configured to enable SNMP security:

  • Accepted community names. The service has no default community name. By default, SNMP will not respond to any community names presented. You can add, delete, or change multiple community names. If an SNMP request is received from a community that is not on this list, it will generate an authentication trap.

    • You can define community rights for a community name. A permission level can be selected in the SNMP Service Configuration dialog box, that determines how the SNMP agent processes requests from a selected community. For example, you can configure the permission level to block the SNMP agent from processing any requests from a specific community.

  • Accept SNMP packets from any host. In this context, no SNMP packets are rejected on the basis of the name or address of the source host or the list of acceptable hosts.
  • Accept SNMP packets from these hosts. In this context, the list of acceptable hosts means the acceptable SNMP management systems. This option is selected by default with localhost as the only hostname. Only SNMP packets received from localhost are accepted. SNMP messages from all other hosts are rejected and an authentication trap is sent. This option provides a higher level of security than using a community name, which might contain many hosts.
  • Send authentication trap. Authentication is the process of verifying that a host name or address is valid. When the SNMP agent receives a request that does not contain the correct community name or is not sent from a member of the acceptable host list, the agent sends an authentication trap message to one or more trap destinations (management systems), indicating the failure of authentication. This option is selected by default.

For more information on how to configure SNMP security, see To configure SNMP security properties.

Note

  • The default Security tab settings are no communities listed under Accepted community names and one host name, localhost, under Accept SNMP packets from these hosts. The term localhost refers to the loopback interface on the local computer. You must add a community name of your choice to Accepted community names. For security reasons, naming a community Public is not recommended. You should monitor and update the settings on an ongoing basis to ensure timely detection of any unauthorized access.


Securing SNMP messages with IPSec

By configuring IPSec policies on all SNMP agents and managers, you can help prevent malicious users and attackers from intercepting SNMP messages. If you cannot configure IPSec policies on all SNMP hosts but you want to ensure that all hosts can communicate with each other, you must configure IPSec policies that allow plaintext communication. However, allowing plaintext communication is not recommended.

IPSec does not automatically encrypt the SNMP traffic. You must create filter specifications in the appropriate IP filter list for traffic between the SNMP managers and agents.

To make SNMP messages more secure, you must add two sets of filter specifications to a new or existing IPSec policy on the SNMP-enabled host. The first set of filter specifications regulates typical SNMP traffic or SNMP messages between the SNMP managers and the SNMP agents. This set of filter specifications typically consists of one filter specification for inbound traffic and one for outbound traffic. You must create these specifications in the IP Filter Properties dialog box. For more information about creating filter specifications, see Filter list, To set an active IP filter list for a rule, and To add, edit, or remove IP filter lists.

On the Addresses tab:

  • In Source address, click A specific IP address and type the address of the SNMP manager.
  • In Destination address, click My IP Address, which refers to the IP address of the SNMP agent to which the policy is assigned.
  • Select the Mirrored check box to automatically create the filter specification for outbound traffic.

On the Protocol tab:

  • Under Select a protocol type, click TCP or UDP. If you require both these protocols, create an additional filter specification.
  • Click From any port, click To this port, and type 161.

The second set of filter specifications regulates trap messages, and it consists of one filter specification for inbound traffic and one for outbound traffic:

On the Addresses tab:

  • Under Source address, click A specific IP address and type the IP address of the SNMP agent.
  • Under Destination address, click My IP Address, which refers to the IP address of the SNMP manager to which the policy is assigned.
  • Select the Mirrored check box to automatically create the outbound filter specification.

On the Protocol tab:

  • Under Select a protocol type, click TCP or UDP. If you require both these protocols, create an additional filter specification.
  • Click From any port, click To this port, and type 162.

For more information on SNMP messages, see SNMP messages.

To send secure SNMP messages, you must configure IPSec policies on SNMP managers as well as SNMP agents. The Windows Server 2003 family supports but does not include SNMP management software.


SNMP service properties

You can use the General, Log On, and Recovery tabs in SNMP Service Properties to configure how the SNMP service starts, logs on to the system, and recovers from an abnormal program termination of the service or operating system.

For information on changing these properties, see Services.


Managing SNMP from the command line

You can use the evntcmd command to configure SNMP traps based on events recorded in system logs. You can also use this command to specify where trap messages are sent within an SNMP community. For information on how to use the evntcmd command to configure traps and trap destinations, see evntcmd. For information on identifying the events from which you can configure traps, see Event Viewer.

You can use the evntwin command to start Event to Trap Translator, which is a graphical utility you can use to configure the translation of events to traps. However, you cannot use Event to Trap Translator to configure trap destinations. For information on configuring trap destinations using the SNMP console, see To configure traps.

You must install SNMP before either the evntcmd command or the evntwin command will work.

For information about other command-line utilities, see Command-line reference. For more information about manageability, see Management strategies and tools.


Troubleshooting

What problem are you having?

My SNMP agent is not functioning.

Cause: An unknown network or SNMP problem.

Solution: SNMP error handling is integrated with Event Viewer. Use Event Viewer if you suspect there is a problem with the SNMP service. You can configure a View filter to display only SNMP messages.

See also: Event Viewer.

My SNMP management system keeps timing out while querying the WINS server.

Cause: The SNMP time-out period is too short or the WINS server is off-line or unreachable.

Solution: Increase the SNMP time-out period on the SNMP management system. If that does not work contact your system administrator to check the WINS server.