Proper SNMP config on a Windows managed server

[Dana Swanson]

Hi All,

After calling hp support at various times I've been advised 3 different ways to configure SNMP on a Windows 2003 managed server.

I've read posts here and read what information I could find on snmp in the documentation.

I've made an educated guess here.

Example settings---->

Example HPSIM Server Hostname: hpsim
Example FQDN: hpsim.domain.com

SNMP settings for example Windows
Server 2003:

Traps---->
Community Name Trap Destinations
public hpsim.domain.com

Security---->
Send authentication trap: On
Accepted Community Names Community Rights
public READ ONLY
private READ CREATE(?)

Accepted Hosts:
Accept any SNMP packets from any host
[or lock down the hosts here]

The hpsim.domain.com server would be setup with the same snmp settings but sending read and write traps to itself via the same community names as configured on the managed clients? I'm not sure on this one, does the server need to send read and write traps to itself?

I've read a write community name is needed but snmp writes do not occur on the network. SNMP writes are done via https protocol or another secure protocol since snmp is open text.

So I assume sending write traps from a managed client to the hpsim server are not needed?

If anyone can help clear this up I would be grateful.

Thanks!

Dana

[Rob Buxton · Accepted solution]

Yep I think that's mainly correct. here's my interpretation.
The HP Agent uses SNMP Sets to set things like thresholds, so it uses the SNMP Write internally on the server. So that is why no snmp writes are done "over the wire". So it's only required for localhost.

SNMP needs to allow the HPSIM Server and local host access. I Allow all for snmp on the HPSIM Server itself. This allows identification etc. to work. This is all Read Only.

SNMP needs to send snmp traps to the HPSIM Server. These are generated by the agents when failures / issues are detected. Again this is Read Only.

[Dana Swanson]

Thanks Rob,

It's nice to hear from someone that manages hpsim.

One of the answers from tech support was to send write and read traps to the hpsim server as well as sending write and read traps to the localhost.

Not to say this didn't fix some old versions of the insight agents perhaps.

I guess if I can reboot the server via the SMH, set a threshold and have it stay set I'll be all set with the snmp config on the client side as far as write goes.

I've never had any event/trap issues with snmp except too many of them! :) Like the occasional over complaining insight agents.

Thanks!

Dana

[David Claypool]

Well, there's no such thing as "write and read traps," there's just traps. And unless there's some application there to receive the traps, there's no reason to send traps to localhost (SMH doesn't do this).

[Dana Swanson]

Thanks Dave,

Mind if I post the example again, this time config from a managed client and hpsim (CMS) server?

I can attach a file and adjust it if any changes were needed. This way if you would like to make reference to it people could download it in the future when asking the same question. And I can have a base doc to work our standard on.

SNMP seems to work with hpsim even if you misconfigure it to a point I've noticed. But there may be issues that you don't notice.

I'll go ahead and type something up and reply to this message.

Thanks!

Dana

[Dana Swanson]

Hi Dave and Rob,

Could you take a look at my settings here and let me know if they are correct?

I forgot to ask about the HPSIM CMS SNMP settings so I've included a example.

I'll attach "Example SNMP Settings.rtf" and have the same information in the text box.

Example of SNMP settings:

<----------------------------------------->

Example SNMP config for a managed system:

Security Tab-->

Send authentication trap: On

Accepted Community Names:

Community Rights
--------- ------
public READ ONLY
private READ WRITE

Accepted Hosts: Accept any SNMP packets
from any host

Traps Tab-->

Community Name Trap Destinations
-------------- -----------------
public hpsim.domain.com

<----------------------------------------->

Following settings unique to the
HPSIM CMS Server only---->

HPSIM Server Nodename: hpsim
HPSIM Server FQDN: hpsim.domain.com

Security Tab-->

Send authentication trap: On

Accepted Community Names:

Community Rights
--------- ------
public READ ONLY
private READ WRITE

Accepted Hosts: Accept any SNMP packets
from any host

Traps Tab-->

Community Name Trap Destinations
-------------- -----------------
public 127.0.0.1

<----------------------------------------->

Thanks!

Dana

[Dana Swanson]

I've heard different configurations for the hpsim server as well. Looks like I have the managed client example above correct.

I'm not sure about the hpsim server (cms) snmp config.

I've heard don't configure it to configure it like I have above and the same as above with public and private traps being sent to the hpsim cms itself.

Any idea on how the hpsim server (CMS) should be setup SNMP wise?

Thanks,

Dana

[David Claypool]

Configuration of the HP SIM server can and should be the same as all other servers.

[Dana Swanson]

Thanks Dave,

Dana

[Dana Swanson]

I've attached "Example SNMP Settings.rtf" with the basic snmp config with some comments to help. Maybe it will help someone out one day.

Thanks again all,

Dana