Configuring NQA on Comware 5 H3C S5800-60C-PWR

[pattap]

So like in the subject, I'm trying to configure NQA, see the below lilttle diagram:

5800A ----- ISP kit -------- ISP P2P link -------- ISP kit ----- 5800B

config used on 5800A

nqa entry test icmp
 type icmp-echo
  destination ip B
  frequency 360
  history-record enable
  history-record number 15
  next-hop B
  probe count 5
  reaction trap probe-failure 4
  source interface Vlan-interface A2B
  ttl 2

What I'm trying to achieve is that if 5800B can't be pinged across the 2P2 link it would generate a trap and send it to IMC

something like this if you were to ping across the link:

ping -a IP A -i vlan-interface A2B -c 5 IP B -- if that fails I want IMC to be notified

Now I can see he NQA working while debugging but no trap is received at IMC end, some logs below:

*Sep  1 11:04:32:945 2016 "S5800A" SNMP/7/TRAP_WARNING:
   no available remote configuration parameters for generating trap

#Sep  1 11:04:34:041 2016 "S5800A" NQA/4/NQA Trap: 1.3.6.1.2.1.80.0.3<pingTestCompleted> NQA entry test icmp test complete trap information: pingCtlOwnerIndex: test, pingCtlTestName: icmp, pingCtlTargetAddressType: 1, pingCtlTargetAddress: "IP B", pingResultsOperStatus: 1, pingResultsIpTargetAddressType: 0, pingResultsIpTargetAddress: , pingResultsMinRtt: 2, pingResultsMaxRtt: 4, pingResultsAverageRtt: 2, pingResultsProbeResponses: 5, pingResultsSentProbes: 5, pingResultsRttSumOfSquares: 42, pingResultsLastGoodProbe: 7.224.9.1.11.4.33.0.0.0.0.

I've checked if pingMIB is available on IMC and it is. Not sure what I'm doing wrong here?

[Ian Vaughan]

Hello,

Please excuse any dumb questions:

Does iMC display other SNMP trap alerts from the 5800 - i.e. is it only these NQA ones that don't seem to be getting through or is it a general issue with SNMP traps?

Do you have the trap destination host and other SNMP information configured on the switch?

As you seem to have a good working iMC server would it be worth adding the Service Health Manager as a free trial and drive the NQA deployment from iMC/SHM module so that it is set up exactly as iMC wants it?

These guys in this article - seem to have got it working - some of it is a bit hard to follow in the broken english but you'll get the idea.  They have even made a youtube video.

They seem to have prototyped it all on either VSR software routers or the Comware Simulator.

Hopefully that will get you on the right track. Don't forget to press the "Kudos" and "Solved" buttons to let others know when posts are helpful / informative / amusing.

Many thanks

Ian

[pattap]

Good point, I've tried testing snmp trap and it didn't seem to get through to IMC

[S5800-hidecmd]_test trap
Test trap have Sended! - nothing has been received at IMC end

config for SNMP seems to be including all that's needed

snmp-agent
 snmp-agent local-engineid xxxxxxxxxxxxxxxxxxxxx
 snmp-agent community read xxxx1
 snmp-agent community write xxxx2
 snmp-agent sys-info contact xxxxxxxx
 snmp-agent sys-info location xxxxxxx
 snmp-agent sys-info version all
 snmp-agent target-host trap address udp-domain x.x.x.x params securityname xxxx2
 snmp-agent target-host trap address udp-domain x.x.x.x params securityname xxxx1
 undo snmp-agent trap enable ospf 1  iftxretransmit

also:

[S5800]dis snmp-agent trap-list
   acfp trap enable
   arp trap enable
   bfd trap enable
   bgp trap enable
   configuration trap enable
   flash trap enable
   mpls trap enable
   ospf trap enable
   standard trap enable
   system trap enable
   vrrp trap enable

I'll have a look at iMC/SHM module and the article later on

Thanks for the input Ian!

[Ian Vaughan]

Howdy,

Just while I'm thinking about it (these things sometimes dawn on me at strange times of the day and night)

Do you have a hole in your firewall (UDp 162 I think - best to check) to let "unsolicited" traps from a host on the network access the iMC server?

If all of the other actions are "server initiated" and build a rule in the stateful firewall maybe this one is bouncing off the server if the port is being defended?

Worth checking just in case

Don't forget Kudos or Solved buttons if this helped / provoked / amused

Thanks

Ian

[pattap]

Hello!

There isn't any filtering involved, all of it is connected via p2p links so the issues would be either on IMC or the 5800s themselves

[Ian Vaughan]

Sorry,

I wasn't being too clear - I meant the firewall on the server hosting IMC. 

Hopefully you've got that covered but you never know. 

I put my IMC on Fedora/MySQL to get away from the MS Svr / SQL Server combo but that was just personal preference. 

thanks

Ian 

[pattap]

ah ok I didn't think of that but then having other 100s of switches working fine would make me thinking that's set ok

I'll still speak to people looking after that bit to double check

I've just tested SNMP from the IMC: I went to device details > modify snmp settings > test

that returned the below pop up window with the below message:

Success

Device "DEVICE IP x.x.x.x" parameters successfully tested

can we considered that as a valid test confirming SNMP working correctly?