Scanning with SNMP

View as Markdown

The Simple Network Management Protocol (SNMP) is an open standard network protocol for collecting information about devices on a network. runZero supports the three main versions of the protocol: SNMPv1, the SNMPv2c variant of SNMPv2, and SNMPv3.

You can run runZero scans with any of these SNMP configurations:

  • SNMPv1 and SNMPv2 enabled
  • Only SNMPv3 enabled
  • SNMPv1, SNMPv2, and SNMPv3 enabled

SNMP scanning adds visibility and network context, and it improves reporting.

Who is this playbook for and why?

This playbook is for runZero users who want to configure SNMP scanning to gather more detail and context about their network and improve reporting.

How will runZero help?

SNMP scanning collects extra information from assets running an SNMP service, and runZero merges that data into the matching asset record. The result is more accurate mapping of devices to switches in reports, and quick queries that show which devices are running SNMP.

What will I need to do?

To get insight from SNMP scanning, runZero recommends these steps:

  1. Configure SNMP credentials.
  2. Configure each scan.
  3. Review the Switch Topology report and use queries.

Prerequisites

To scan with SNMP, you need:

  • A runZero account with at least one Explorer deployed
  • An SNMP community string (SNMP v1/v2) or SNMP credentials (SNMP v3)

Implementation steps

These steps configure your scans to include SNMP.

Step 1: Configure SNMP credentials

  1. Go to the Scanning with credentials section of the runZero console to configure credentials for SNMP v1/v2 or v3.
  2. Click Add credential on the Credentials page.
  3. Add a credential for SNMP v1/v2 by following step 4, or for SNMP v3 by following step 5.
  4. To add a credential for SNMP v1/v2:
    A credential for SNMP v1/v2 community strings is optional; you can also set community strings in the scan task configuration. A credential does let you use the CIDR allow list to control which parts of the network receive the community strings.
    • Set Credential type to SNMP v2 communities.
    • Enter a descriptive name for the credential in the Name field.
    • Set Community to your v1/v2c community strings (comma-separated).
    • In the CIDR allow list, set which IP addresses receive these community strings.
  5. To add a credential for SNMP v3:
    • Set Credential type to SNMP v3 credential.
    • Enter a descriptive name for the credential in the Name field.
    • Set Username to the username for SNMP v3 authentication.
    • Select the appropriate protocol in the Authentication protocol field.
      The authentication protocol sets the hashing algorithm applied to the authentication passphrase, which determines how the Explorer authenticates to the assets.
    • Set the Authentication passphrase.
    • In the CIDR allow list, set which IP addresses receive the SNMP v3 credentials.
    • Specify the SNMP v3 context in the Context field (optional).
    • Specify the Privacy protocol and Privacy passphrase in their respective fields (optional).
      • The privacy protocol sets how data sent to and from assets is encrypted.
      • The privacy passphrase seeds the encryption.

Step 2: Configure each scan

  1. Create or edit a scan task.
  2. On the Credentials tab, enable the SNMP credentials you want this scan task to use, and disable any SNMP or other credentials you don’t.
  3. On the Probes and SNMP tab, review the SNMP section. If needed, enter the community strings for SNMP v1/v2 scanning in the snmp-comms field.
    If you remove a community string from this field, the scan task probes it only when an enabled SNMP v2 communities credential specifies it. If you remove every community string from this field and no SNMP v2 communities credentials are configured or enabled, the task performs no SNMP v1/v2 scanning.

Step 3: Review the Switch Topology report and use queries

Once your SNMP scans have completed and processed, open the Switch Topology report in the Reports section of the console. It shows the layer-2 link information extracted from SNMP-enabled switches and how assets and switches connect on your network. You can also find unmapped assets there and investigate why SNMP isn’t mapping them to switches.

runZero tracks the SNMP protocol versions it finds on each asset during a scan, so a query such as protocol:snmp2 quickly finds every asset with the same attribute. Reports show how SNMP information was collected on particular assets: the SNMP Auth Report shows which credential authenticated, the SNMP v1/v2 community report shows the community string that was used, and the SNMP v3 failedAuth report shows whether authorization failed.

Relevant runZero resources

Getting help

For help building out this process, book a session with a runZero Customer Success Engineer.

Updated