4

I have a CentOS server (7.2). I am trying to configure this as a SNMP trap receiver.

In my snmptrapd configuration, I am calling a very basic shell script just to identify if the trap was received:

[root@centos-Main snmp]# cat /etc/snmp/snmptrapd.conf
 authCommunity   log,execute,net public
traphandle default /etc/snmp/mydummyhandler.sh

This is what mydummyhandler.sh looks like:

[root@centos-Main snmp]# cat mydummyhandler.sh
echo "Trap Received" >> /var/log/snmptraplog.txt

But when traps are sent from the Juniper router, my snmptrapd doesn't process it and does not write anything to /var/log/snmptraplog.txt.

I sent few test traps from localhost itself and it is completely working as expected. Further, to check this, I tried sending a test trap from another CentOS server like below:

snmptrap -v 2c -c public centos-Main .1.3.6.1.6.3.1.1.5.3 .1.3.6.1.6.3.1.1.5.3    \
> ifIndex i 2 ifAdminStatus i 1 ifOperStatus i 1

and it was processed as expected too:

[root@centos-Main snmp]# cat /var/log/snmptraplog.txt
Trap Received

I ran a tcpdump on port 162 of trap receiver server and found that the traps sent from Juniper switch is reaching the server. But for some reason, it is silently ignoring the incoming traps from the Juniper device without further processing.

Here is what I see when traps are sent from Juniper device:

[root@centos-Main snmp]# tcpdump -i enp0s3 port 162
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on enp0s3, link-type EN10MB (Ethernet), capture size 65535 bytes
16:54:14.521820 IP 192.168.0.91.58376 > centos-Main.snmptrap:  C=VINOD V2Trap(217)  system.sysUpTime.0=1768202 S:1.1.4.1.0=E:2636.4.13.0.1 E:2636.3.37.1.1.0="'Event-Trap'" E:2636.3.37.1.2.1.2.1="'event'" E:2636.3.37.1.2.1.3.1="''" E:2636.3.37.1.2.1.2.2="'message'" E:2636.3.37.1.2.1.3.1="''" S:1.1.4.3.0=E:2636.1.1.1.2.1

Also, for comparison I am pasting the tcpdump output of successful trap reception from another server:

[root@centos-Main snmp]# tcpdump -i enp0s3 port 162
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on enp0s3, link-type EN10MB (Ethernet), capture size 65535 bytes
16:53:23.272673 IP 192.168.0.105.49182 > centos-Main.snmptrap:  V2Trap(87)  S:1.1.4.1.0=S:1.1.5.3 interfaces.ifTable.ifEntry.ifIndex=2 interfaces.ifTable.ifEntry.ifAdminStatus=1 interfaces.ifTable.ifEntry.ifOperStatus=1

1 Answer 1

2

You've set snmptrapd to accept traps with community name public only:

[root@centos-Main snmp]# cat /etc/snmp/snmptrapd.conf
authCommunity   log,execute,net public

But the trap from the Juniper device uses the community name VINOD instead:

[root@centos-Main snmp]# tcpdump -i enp0s3 port 162
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on enp0s3, link-type EN10MB (Ethernet), capture size 65535 bytes
16:54:14.521820 IP 192.168.0.91.58376 > centos-Main.snmptrap:  C=VINOD V2Trap(217) ...
                                                               ^^^^^^^

You should either configure the Juniper device's trap community name to public, or add another authCommunity line to your snmptrapd.conf file:

authCommunity  log,execute,net VINOD

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .