Configuring SNMP in Gaia Clish

For detailed information, see sk90860: How to configure SNMP on Gaia OS.

Important:

On Scalable Platforms (Maestro and Chassis), you must run the applicable commands in Gaia Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. gClish of the applicable Security Group.
Scalable Platforms do not support the "set snmp traps" command.

You must use the "asg alert" configuration wizard to configure SNMP traps in Gaia gClish.
After you add, configure, or delete features, run the "save config" command to save the settings permanently.

Best Practice:

For commands that include "auth-pass-phrase", "privacy-pass-phrase", or both, use the hashed commands.

To get the hashed password, run the "show configuration snmp" command.

Syntax for the 'add' commands

Note - To see all available commands:

Enter:

add snmp
Press <SPACE>
Press <ESC><ESC>

Syntax

add snmp interface <Name of Interface>

add snmp traps receiver <IPv4 address> version {v1 | v2 | v3} community <String>

add snmp custom-trap <Custom Trap Name> oid <Value> operator <Logical Operator> threshold <Value> frequency <Value> message "<Text>"

add snmp usm user <UserName> security-level authPriv auth-pass-phrase <Pass Phrase> privacy-pass-phrase <Privacy Pass Phrase> privacy-protocol {DES | AES} authentication-protocol {MD5 | SHA1}

add snmp usm user <UserName> security-level authPriv auth-pass-phrase-hashed <Hashed Pass Phrase> privacy-pass-phrase <Privacy Pass Phrase> privacy-protocol {DES | AES} authentication-protocol {MD5 | SHA1}

add snmp usm user <UserName> security-level authNoPriv auth-pass-phrase <Pass Phrase> authentication-protocol {MD5 | SHA1}

add snmp usm user <UserName> security-level authNoPriv auth-pass-phrase-hashed <Hashed Pass Phrase>

Description of commands

Command	Description
`add snmp custom-trap ...`	Adds a custom SNMP trap: `<Custom Trap Name>` Specifies the name of the custom trap. Range: 1 - 128 characters. `oid <Value>` Specifies the SNMP OID to query. The OID value can contain only numbers and periods (sub-identifiers separated by periods). The OID value can contain from 2 to 128 sub-identifiers: from `X.X` to `X.X.`(124 sub-identifiers more) Number range of each sub-identifier: 0 - 4294967295. The first sub-identifier must be one of these numbers: `0` In this case, the second sub-identifier must be between 0-39: `0.<0-39>.`(other applicable sub-identifiers) `1` In this case, the second sub-identifier must be between 0-39: `1.<0-39>.`(other applicable sub-identifiers) `2` `2.X.`(other applicable sub-identifiers) `operator <Logical Operator>` Specifies the operator to examine the value the SNMP OID to query returns: `Equal` - The returned value is equal to the value in the "`threshold`" parameter. `Not_Equal` - The returned value is not equal to the value in the "`threshold`" parameter. `Less_Than` - The returned value is less than the value in the "`threshold`" parameter. `Greater_Than` - The returned value is greater than the value in the "`threshold`" parameter. `Changed` - The returned value is different than the returned value in the previous SNMP OID query. `threshold <Value>` Specifies an integer value to which Gaia operating system compares the value returned in the SNMP OID query. Range: 1 - 128 characters. `frequency <Value>` Specifies the interval (in seconds) between the SNMP OID queries. Range: 1 - 4294967295. `message "<Text>"` Specifies the applicable text. This is the message you get in the SNMP Trap packets the Gaia operating system sends. Range: 1 - 128 characters.
`add snmp interface ...`	Adds a local interface to the list of local interfaces, on which the SNMP daemon listens.
`add snmp traps receiver ...`	Adds a SNMP Trap Sink.
`add snmp usm user ...`	Adds an SNMPv3 USM user.

Syntax for the 'set' commands

Note - To see all available commands:

Enter:

set snmp
Press <SPACE>
Press <ESC><ESC>

Syntax

set snmp agent {on | off}

set snmp agent-version {any | v3-Only}

set snmp clear-trap interval <Value> retries <Value>

set snmp custom-trap <Custom Trap Name> oid <Value> operator <Logical Operator> threshold <Value> frequency <Value> message "<Text>"

set snmp traps coldStart-threshold <Seconds>

set snmp traps polling-frequency <Seconds>

set snmp traps receiver <IPv4 address> version {v1 | v2 | v3} community <String>

set snmp traps trap {authorizationError | biosFailure | coldStart | configurationChange | configurationSave | fanFailure | highVoltage | linkUpLinkDown | lowDiskSpace | lowVoltage | overTemperature | powerSupplyFailure | raidVolumeState | vrrpv2AuthFailure | vrrpv2NewMaster | vrrpv3NewMaster | vrrpv3ProtoError}

set snmp traps trap-user <UserName>

set snmp community <String> {read-only | read-write}

set snmp contact <Contact Information>

set snmp location <Location Information>

set snmp mode {default | vs}

set snmp usm user <UserName> security-level authPriv auth-pass-phrase <Pass Phrase> privacy-pass-phrase <Privacy Pass Phrase> privacy-protocol {DES | AES} authentication-protocol {MD5 | SHA1}

set snmp usm user <UserName> security-level authPriv auth-pass-phrase-hashed <Hashed Pass Phrase> privacy-pass-phrase <Privacy Pass Phrase> privacy-protocol {DES | AES} authentication-protocol {MD5 | SHA1}

set snmp usm user <UserName> security-level authNoPriv auth-pass-phrase <Pass Phrase> authentication-protocol {MD5 | SHA1}

set snmp usm user <UserName> security-level authNoPriv auth-pass-phrase-hashed <Hashed Pass Phrase>

set snmp usm user <UserName> {usm-read-only | usm-read-write}

set snmp usm user <UserName> vsid {all | <IDs of allowed Virtual Devices> }

set snmp vs-direct-access {on | off}

Description of commands

Command

Description

set snmp agent-version {any | v3-Only}

Configures the supported SNMP version:

all - Support SNMP v1, v2 and v3.
v3-Only - Support SNMP v3 only.

set snmp agent {on | off}

Enables (on) or disables (off) the SNMP Agent.

set snmp clear-trap ...

Configures the indication of a custom SNMP trap termination.

set snmp community <String> {read-only | read-write}

Configures the SNMP community password and if this password lets you only read the values of SNMP objects (read-only), or set the values as well (read-write).

set snmp contact ...

Configures the contact name for the SNMP community.

set snmp custom-trap ...

Configures the settings of an existing custom SNMP trap.

See the explanations in the "add snmp custom-trap" command.

set snmp location ...

Configures the contact location for the SNMP community.

set snmp mode {default | vs}

Configures how to run the SNMP daemon:

default
- On non-VSX Gateway Physical server that hosts VSX virtual networks, including all Virtual Devices that provide the functionality of physical network devices. It holds at least one Virtual System, which is called VS0., this is the only supported mode.
- On VSX Virtual System Extension. Check Point virtual networking solution, hosted on a computer or cluster with virtual abstractions of Check Point Security Gateways and other network devices. These Virtual Devices provide the same functionality as their physical counterparts. Gateway, SNMP daemon runs only in the context of VS0.
vs
- For VSX Gateway only.
- Each Virtual Device has a separate SNMP daemon running in the context of that Virtual Device.

set snmp traps coldStart-threshold <Seconds>

Configures the threshold for the SNMP coldStart trap.

set snmp traps polling-frequency <Seconds>

Configures the polling interval for the SNMP traps.

set snmp traps receiver ...

Configures the IPv4 address of the SNMP Trap Sink.

set snmp traps trap-user <UserName>

Configures the user, which will generate the SNMP traps.

set snmp traps trap ...

Configures the Gaia built-in SNMP traps.

set snmp usm user <UserName> ...

Configures the SNMPv3 USM user.

Notes:

When you change the configured Authentication Protocol of an existing SNMPv3 USM user, Gaia OS requires you to change the Authentication Pass Phrase because the previous password is not valid anymore.
When you change the configured Privacy Protocol of an existing SNMPv3 USM user, Gaia OS requires you to change the Privacy Pass Phrase because the previous password is not valid anymore.

set snmp vs-direct-access {on | off}

Enables (on) and disables (off) the SNMP direct queries on the IP address of a Virtual System (not only VS0), or Virtual Router.

This mode works only when SNMP vs mode is enabled.

See the:

Syntax for the 'delete' commands

Note - To see all available commands:

Enter:

delete snmp
Press <SPACE>
Press <ESC><ESC>

Syntax

delete snmp clear-trap

delete snmp traps coldStart-threshold

delete snmp traps polling-frequency

delete snmp traps receiver <IPv4 address>

delete snmp traps trap-user <UserName>

delete snmp custom-trap <Custom Trap Name>

delete snmp community <String>

delete snmp contact <Contact Information>

delete snmp location <Location Information>

delete snmp interface <Name of Interface>

delete snmp usm user <UserName>

Description of commands

Command	Description
`delete snmp clear-trap`	Removes the indication of a custom SNMP trap termination.
`delete snmp community <String>`	Removes the SNMP community password.
`delete snmp contact ...`	Removes the contact name for the SNMP community.
`delete snmp custom-trap <Custom Trap Name>`	Removes the custom SNMP trap.
`delete snmp interface <Name of Interface>`	Removes the local interface from the list of local interfaces, on which the SNMP daemon listens.
`delete snmp location ...`	Removes the contact location for the SNMP community.
`delete snmp traps coldStart-threshold`	Removes the threshold for the SNMP `coldStart` trap.
`delete snmp traps polling-frequency`	Removes the polling interval for the SNMP traps.
`delete snmp traps receiver <IPv4 address>`	Removes the IPv4 address of the SNMP Trap Sink.
`delete snmp traps trap-user <UserName>`	Removes the user, which will generate the SNMP traps.
`delete snmp usm user <UserName>`	Removes the SNMPv3 USM user.