NFA traps with trap OID different of the MIB

[silvaleandrodp]

I configure the traps of NFA to be send to Spectrum but the traps send are with a trap OID different of that in the reporter mib

 

1.3.6.1.4.1.4498.10.1.6.2 -> This is the oid that are being send

 

 

Below are the traps disponibles in the reporter mib

 

I'm using spectrum 10.0 and NFA 9.3.1

[Christopher Walsh]

Do you have NPC or CAPC?
If so you can add spectrum as a data source, then have NFA send the traps to the NFA Console's IP address.

They will then sync up to CAPC/NPC via Event Manager, and get displayed in the Events report pages.

Then they will sync over to spectrum.

 

Otherwise you may need to edit the OID in spectrum, there are a couple of threads below on this.

 

NFA alerts to Spectrum Alarms

RE: No events from NFA

[silvaleandrodp]

Resolved, apparently there was any incompatibility between the reporter and the MIB compiler of this version of the spectrum.

 

I realized two errors in the MIB:

 

1 macros NOTIFICATION-TYPE, MODULE-IDENTITY had not been imported from SNMPv2-SMI MIB.

 

2 The legacy traps the TRAP-TYPE type are not compatible with SMIv2 MIB files

 

Solution: I edited the MIB, added the two macros above to the import statement and removed the legacy traps of TRAP-TYPE type from file.

 

Below the result

 

[Stuart Weenig]

Did CA bless your version of the MIB? Can you post your edited version of the MIB? I'm having the exact same problem.

[Stuart Weenig]

I did the following to the MIB that came with my NFA installation:

1. Change line 6 to read

OBJECT-TYPE, NOTIFICATION-TYPE, MODULE-IDENTITY FROM SNMPv2-SMI;

2. Search and replace "TRAP-TYPE" with "NOTIFICATION-TYPE"

3. Remove lines 416 to the end, leaving the last line with "END"

 

It compiled, but the trap type still doesn't match the OID coming in from NFA.

[ackjo04]

Stuart,

 

It is not uncommon to see the compiled mib show one trap OID but the actual trap from the device show a different trap OID for the same trap. The one that counts is the one that comes from the device.

 

I have actually seen two of the same type of devices but with different firmware installed send two different trap OID's for the same trap.

 

Joe

[Stuart Weenig]

Yeah, so the problem is that Spectrum still registers the event as an unknown alarm even though the MIBs suggested by Chris are compiled in. The MIB is not actually required to receive the trap, but in order to provide labels for the OID bindings, you need the trap defined in a MIB, that MIB compiled, and the traptype OID must match.

[Stuart Weenig]

The other problem is that as long as the trap comes in as an "unknown alert" (which happens because there is no compiled mib that has a trap definition with a matching traptype OID) the event type is 0x10801, which is the "Unknown alert received" event. I want to have spectrum generate an alarm to be processed by my SANM policy, but I don't want to do it for every "unknown alert received" event. I want the trap definition to allow me to create a new event code and use that event code to create an alarm.

 

The fact that this is so difficult between CA products produced by the same group is a little telling.

[Christopher Walsh]

How to import NFA Mib into Spectrum 

Both Mibs can be found in the above doc.

[Stuart Weenig]

Compiled both those mibs. Neither includes the definition for 1.3.6.1.4.1.4498.10.1.6.2.  Still coming in as unknown alert.

[Robert Kettles]

Perhaps a silly question but did you map the trap to an event after compiling the MIB? 

 

[Stuart Weenig]

Couldn't get that far because this trap isn't listed in the mib tools after compiling the mib.

[ackjo04]

Stuart,

 

I downloaded the NFA.txt and Reported.txt files from How to import NFA Mib into Spectrum and compiled them into Spectrum 10.2.1 MIB Tools. 

 

In your original post, you have the NQreporter-MIB highlighted in MIB Tools which shows traps 8-13. Traps 1-7 are not in the NQreporter-MIB. They are located in the NFA-MIB. See below:

 

 

Joe

[Stuart Weenig]

My OP has a screenshot of the first MIB I compiled, which is the one that comes with NFA. I had since deleted that one and tried the other two suggested in the KB article. 

 

It looks like those two may be working after all. I didn't check the map tab since the traps weren't defined in the tree (why would they show up in the map and not in the tree when some do?). This speaks to the unintuitiveness of the Spectrum OC GUI MIB Tools. Now that I can see the 10.1.0.6 trap in the map tab, I have to create a new map, right? Does that create a new event? Since 10.1.0.7 is the closing trap for 10.1.0.6, how do I setup the alarm to open when receiving the 10.1.0.6 trap and close when the 10.1.0.7 trap comes in, knowing that 10.2.10 and 10.2.11 are the distinguishing factors?

[silvaleandrodp]

Hi Stuart, sorry for the late answer.

 

I uploaded the two mibs to my dropbox folder, i think the custom one should solve your problem, but use for your own risk ok? 

 

Original MIB

Custom MIB

[Christopher Walsh]

I am not too familiar with the Spectrum side, but I know other users got this working with those mibs.  There may be some additional configuration on the spectrum end as Robert noted above.

[Christopher Walsh]

I changed line 35 of the nfa.txt mib from How to import NFA Mib into Spectrum from

     

     traps OBJECT IDENTIFIER ::= {notifications 0}

 

To: 

     traps OBJECT IDENTIFIER ::= {notifications 6}

 

It looks like this may work.

 

[Christopher Walsh]

Attached is the edited NFA.mib which should have the correct OID values.

Attachment(s)

updatedNFA.mib.zip   1 KB 1 version