1

My question is about zabbix traps with SNMPv3 and snmptrapd service using zabbix_trap_receiver.pl. I have a switch on which I enabled SNMPv3 only, so the switch has no SNMPv1/2c rw or ro communities configured, and I was able to add it as a host on zabbix after a long journey modifying existing SNMPv2 templates. In zabbix documentation in snmptrapd.conf there is a couple of lines added as shown here to enable SNMP traps:

authCommunity execute public
perl do "/usr/bin/zabbix_trap_receiver.pl";

My questions:

  • What is the meaning of authCommunity execute public
  • I don't have public community configured, will snmptrapd service be able to decrypt SNMPv3 traps because on wireshark I had to define SNMPv3 credentials for it to be able to show me traps packets content?
  • If not, how can I configure it in snmptrapd.conf so that the perl script can read these traps from SNMPv3?
  • On wireshark, why does it say SNMPv2c trap, although it is encrypted as SNMPv3, I am lost here?
  • Please explain to me how traps work in when SNMPv2 isenabled and when SNMPv3 is enabled?

Edit I also tried the following

createUser -e <engineid> <user> SHA <key> AES <key>
authUser log,execute <user>
perl do "/usr/bin/zabbix_trap_receiver.pl";

But no luck

1

The way snmptrapd daemon works with traps doesn't allow receiving any SNMPv3 traps without specifying the EngineID of the sender device i.e. if you just do the following in /etc/snmp/snmptrapd.conf:

createUser snmpv3USER SHA auth_pass AES priv_pass
authUser log,execute snmpv3USER
perl do "/usr/bin/zabbix_trap_receiver.pl";

You will never get any SNMPv3 traps in your /tmp/zabbix_traps.tmp, because the usmUser created inside /var/lib/net-snmp/snmptrapd.conf is not fulfilling the actual requirements, that's it..

When it comes to SNMPv3 informs, most switches can not send them, so we are stuck with SNMPv3 traps only, and the way snmptrapd is programmed works only with EngineIDs for SNMPv3 traps. Even if I use disableAuthorization yes in snmptrapd.conf, SNMPv3 traps will not work without the EngineID for each sending device i.e. the switch device.

Now, in order to receive SNMPv3 traps, you need to get all EngineIDs for all switches, for that I have written a python script in order to build snmptrapd.conf using SNMPv3 which is a big relief. The actual file has a comment before each createUser line which shows the switch name and IP address. This SNMPv3 traps piece of information is actually mentioned in net-snmp documentation, but when I read it first time I could not understand it because it says The difference is that SNMPv3 TRAPs use the engineID of the local application sending the trap rather than the engineID of the remote application so when you read it first time you will be confused, but with a little bit of concentration it becomes very clear:

SNMPv3 TRAPs are a bit more complicated in some ways, but it makes sense the protocol works this way if you spend a long time thinking about it. The difference is that SNMPv3 TRAPs use the engineID of the local application sending the trap rather than the engineID of the remote application. This means that you have to create users in your remote user database with a bit more care and need to create one for every engineID you wish to send traps from. This means that if you want to have 100 snmp agents send snmpv3 traps to your trap receiver, you need 100 createUser directives in your /var/net-snmp/snmptrapd.conf file.

/etc/snmp/snmptrapd.conf file looks like this:

createUser -e 0x800007c703609c9f1eff01 snmpv3USER SHA auth_pass AES priv_pass
createUser -e 0x800007c703cc4e24e4c6c3 snmpv3USER SHA auth_pass AES priv_pass
createUser -e 0x800007c703d4c19e743e86 snmpv3USER SHA auth_pass AES priv_pass
createUser -e 0x800007c70378a6e10ca715 snmpv3USER SHA auth_pass AES priv_pass
createUser -e 0x800007c70378a6e10c46f0 snmpv3USER SHA auth_pass AES priv_pass
createUser -e 0x800007c70378a6e121bacd snmpv3USER SHA auth_pass AES priv_pass
createUser -e 0x800007c70378a6e121b7d8 snmpv3USER SHA auth_pass AES priv_pass
createUser -e 0x800007c703609c9f5136f4 snmpv3USER SHA auth_pass AES priv_pass

authUser log,execute snmpv3USER
perl do "/usr/bin/zabbix_trap_receiver.pl";

The file is much longer than that, but now I can receive all traps from all switches. I saw on stackoverflow that someone succeeded with DES without using EngineID, but this is real crap, it never worked for me neither for DES nor for AES without EngineID. It's only something that has been done in the background of other monitoring software which do keep a record of EngineIDs of all devices for trap reception task.

I also noticed that the traps from the core switch are received from the virtual interface of the vlan on which zabbix resides, so I had to modify zabbix_trap_receiver.pl script as follows:

use NetSNMP::TrapReceiver; # should be added in order to get the script to work, otherwise it fails -- elekgeek 2nd DEC 2019
# get the host name
        $pdu_info{'receivedfrom'} =~ s/192.168.168.254/192.168.168.1/ig; # I added this line to get the core switch IP instead of zabbix's VLAN SVI IP, otherwise trap is not added to the CORE trap.fallback -- elekgeek 2nd DEC 2019
        my $hostname = $pdu_info{'receivedfrom'} || 'unknown';
        if ($hostname ne 'unknown')

When working on traps, I had to see them as history, so I changed the item SNMP traps (fallback) from Type of information=Log to Type of information=Text in template Template Module Generic SNMPv3.

Good luck zabbixing!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.