SNMP Monitoring
For more about using SNMP, see:
-
R81 Gaia Administration Guide - Chapter System Management - Section SNMP
Supported SNMP Versions
SNMP v1, v2c, and v3 are supported in all monitor modes.
|
|
Note - For SNMP queries of Virtual Devices using the VS0 IP address:
|
Supported SNMP Modes
VSX
supports these SNMP modes:
-
SNMP Default Mode
-
SNMP VS Mode
-
SNMP VS in vs-direct access mode
SNMP Default Mode
In SNMP default mode:
-
The SNMP daemon runs only in the context of VS0 (the VSX Gateway
). -
The VS0 SNMP daemon has a set of tables with counters (VSX SNMP tree) for each Virtual Device.
-
SNMP queries must be sent to IP address of the VSX Gateway (context is VS0).
|
Item |
Description |
|
Item |
Description |
|---|---|---|---|---|
|
1 |
SNMP Server that sends SNMP Requests to VSX Gateway |
|
6 |
Virtual System |
|
2 |
eth0 |
|
7 |
Virtual System in Bridge mode |
|
3 |
VSX Gateway |
|
8 |
Virtual Router |
|
4 |
SNMP Daemon |
|
9 |
Virtual Switch |
|
5 |
Virtual System 0 |
|
|
|
SNMP VS Mode
In SNMP VS mode:
-
Each Virtual Device has separate SNMP daemon running in the context of that Virtual Device.
-
Query for Virtual Devices uses the VS0 IP address.
-
You must run the SNMP query using the interface on the VSX Gateway.
-
The query is relayed to the specified Virtual Device.
-
The Virtual Device sends the response through the same VSX Gateway interface.
-
-
The VS ID must be specified in the SNMP query.
|
|
Note - Default mode query functionality is not decreased when you enable SNMP VS mode. |
SNMP VS in the "vs-direct-access" Mode
-
SNMP VS in the
vs-direct-accessmode is available only when the SNMP VS mode is enabled. -
Enables SNMP queries on the IP address of a Virtual System (not only VS0), or Virtual Router.
Notes:
-
For cluster
deployments, you can query only Virtual IP addresses. -
Only Virtual Devices with an IP address can be queried, not Virtual Switches or Virtual Bridges.
-
Configuring SNMP Modes
Each Virtual System must meet these requirements:
SNMP USM user
-
To use SNMP v3 queries, an SNMP USM user must be defined.
For more on USM user creation commands, see the R81 Gaia Administration Guide.
-
To use SNMP v3 queries on VSX, the USM user must be configured with the allowed Virtual Devices:
set snmp usm user <User_Name> vsid <VSID> -
By default, a USM user in VSX has no allowed Virtual Devices.
Allowed interfaces
If you enable the vs-direct-access mode, the Virtual System accepts SNMP queries on all the interfaces.
To prevent SNMP queries for a specified interface, add a new rule to the policy that blocks SNMP traffic on that interface.
Query source
In the vs mode and the vs-direct-access mode, there is no specification for query source.
All sources allowed in the Security Policy are valid.
Running SNMP Queries
When you query a Virtual System Load Sharing cluster with the VSX Cluster Member (VS 0) Virtual IP address, the Virtual System on the Active VSX Cluster Member (VS 0) replies to the query.
An Active Virtual System on a Standby VSX Cluster Member does not reply to the query.
If you want to query the Active Virtual System on a Standby VSX Cluster Member, use the real IP address of the VSX Cluster Member.
SNMP Configuration
See the R81 Gaia Administration Guide and sk90860: How to configure SNMP on Gaia OS.
|
To Configure |
Run |
|---|---|
|
SNMP Default |
|
|
SNMP mode VS |
|
|
SNMP direct-vs-access |
|
Example SNMP queries for Virtual Systems
This section shows example SNMP queries.
The VSX SNMP Tree
To get information from a Virtual Device (Virtual System, Virtual Switch, or Virtual Router), you must load the Check Point MIB file into your SNMP Browser.
-
The MIB file on the VSX Gateway (context of VS 0) is:
$CPDIR/lib/snmp/chkpnt.mib -
The VSX OID is:
.1.3.6.1.4.1.2620.1.16
Example commands in the Expert mode:
-
To run an SNMP v2c query for VSX status table, run:
snmpwalk -m $CPDIR/lib/snmp/chkpnt.mib -c public -v 2c 192.0.2.83 vsxStatusTable -
To run an SNMP v3 query for the VSX memory usage table, run:
snmpwalk -m $CPDIR/lib/snmp/chkpnt.mib -v 3 -l authNoPriv -u admin -A abcd1234 192.0.2.83 vsxStatusMemoryUsageTable
The vsxCountersTable refresh time:
The vsxCountersTable refresh time is configured in this file:
$FWDIR/conf/amon_vsx_refresh_interval
The default value is 30 (seconds).