So now that we've talked a little bit about the different SNMP versions,
let's talk a bit about managing network devices on a very high level.
There are two methods of using SNMP from a network management station,
that is the SNMP Get and the SNMP put.
The get sounds just like it says, it gets information from the managed device.
It uses a MIB to determine what object ID,
or OID, to use, and it uses read-only access to get this information.
The SNMP Put, as the name implies,
allows you to put or change information on the device.
It requires a read-write community string access and this change can
be everything from changing an interface name,
overwriting the configuration, rebooting the device,
really, it's up to the manufacturer what they support from an SNMP Put.
I know on a Cisco router you can actually put a configuration on
there using SNMP if you've done something like forgotten the
enable password or something like that.
Now as we discussed earlier when we talked about SNMP v1 and SNMP v2c,
the read-only and read-write community strings are just that,
they are strings that are sent plain text over the network,
and so,
you really have to consider locking down your management station and
your management agents so that rogue actors cannot do things to your
network that you do not want them to.
Lastly, we'll talk about the difference between SNMP polling versus traps.
Now polling is kind of what we've been talking about this whole time.
We have a management station and we have servers down
here that we're going to manage, servers or anything,
and basically,
what happens is the management station sends a request to the
device and the device replies back with the information that was
requested and it may do this once a minute,
once every 5 minutes, it depends on the configuration that you use.
An SNMP trap is pretty much the opposite.
You have the network management station up here and you
have the network devices down there, servers,
routers, switches, etc, and something happens on one of these devices,
say someone modifies the configuration, or changes an interface name,
or fill in the blank,
you can tell the devices to send a trap back to the SNMP management
station where you can then fire off alerts or,
in the case of Cisco routers and switches,
if you get a trap that someone has modified the configuration,
you can kick off a job to pull back the configuration and compare it
for any changes and alert someone to the changes,
that way you don't have someone just modifying your router or
switch configuration in the middle of the day.
On a production network,
you're going to see 95% polling and devices that also send traps,
and again, those are more infrastructure type devices,
things like HVAC systems, and routers, and switches,
and PDUs because you're going on the assumption that hey these devices
are working normally unless they tell me otherwise.
Even for devices that use SNMP traps almost exclusively,
it's still a good idea to have an SNMP Get every so often to
poll a device to say hey are you still there,
is everything still good with you, otherwise,
you might have a device that goes offline,
you never get a trap and you never know about it until
someone calls up asking about it.
So in the next part of the module, we're going to actually look at an SNMP transaction on the wire.