Engine id for SNMPV3 Trap alert configure in UIM 9.02 using snmptd prob

[Sushant Paluskar]

Hi All,

I am doing SNMP trap base alert in CA UIM 9.02 using snmptd probe.
We got details from vendor as below.
UPS ip

Username
Authentication protocol
Privacy protocol
Authentication password
Privacy password

When I put all details in SNMPV3 setup, we missing one item its like engine id
Could you please help me , engine id should I take from vendor or it can fetch from UIM application?
Please let me know, your answer will highly appreciate.

Thanks

[Luc Christiaens]

https://community.broadcom.com/communities/community-home/digestviewer/viewthread?MID=779883-------------------------------------------
https://knowledge.broadcom.com/external/article/12307
https://knowledge.broadcom.com/external/article/121594/uim-snmpv3-traps-not-processed-by-snmptd.html

[Glenn Weavind]

I'm not convinced.  The KB refers to RFC5343 which describes a mechanism for the trap receiver to *discover* a sender's EngineID, as it's clearly unrealistic for any management tool to know, in advance, the EngineID of every possible trap sender.
The current probe does not permit EngineID to be blank (unlike in Spectrum): does the current probe support the referenced EngineID discovery process, please?
If not, then it doesn't make a lot of sense to hide behind the SNMP V3 spec (we *have* to know the sender's EngineID) and then not support the mechanism designed to overcome the obvious limitation of this requirement.
If the probe *does* support this RFC mechanism, how do we use it please?

[Andrew Cooper]

The snmptd probe is very "old" and only just supports v3.  So you have to provide the engineID manually at profile generation time.

What this means is that you need to do the "discover" yourself for each device, however the engineID is exposed in the standard MIB (as defined in the RFC) so something like

snmpget -v3 -l authPriv -u USERID - a SHA -A "<SHA_PASSWORD>"   -x AES -X "<AES_PASSWORD>" <hostname> snmpEngineID.0

will return the engineID used by the device, often it is related to MAC and the device/appliance creates it when snmp v3 is enabled.  The effect of this is that as you cannot define (or manually set) the Engine ID each device will be different and so you need a different user definition for each device.

Regards, Andrew
​​

------------------------------
Knows a little about UIM/DXim, AE, Automic
------------------------------

[Glenn Weavind]

Thanks Andrew.  That seems to confirm my analysis.  It's completely unrealistic to expect folk to enter EngineID in advance, and while this might be possible for 10 trap sources, it's not viable for 100.  SNMP was always a mystery to Fort Collins...
We'll have to use Spectrum.

[Jose Vicente Espinosa]

Hi Glenn,

your analysis did not have into account that engineId discovery process might not be possible from the system running the snmptd probe.

Let's consider a network where you do not have SNMP access to query the device, just receiving traps.

Your alternative is to automate the discovery of engineId and create user dynamically in the snmptd probe configuration.

Regards

[Jose Vicente Espinosa]

Another case is when the source of the trap is a standalone process that does not respond to SNMP.

[Glenn Weavind]

Good points, Jose.  Andrew's observation seems to be very pertinent - it's not clear if the current probe supports SHA-2 (probably not), so that may prevent me using it at all.

[Sam Green]

Reviving an old thread here.  But looking to receive v3 traps from Meraki Cloud.  

Does anyone have any ideas on how to get the EngineID?

[Sam Green]

Sorted this.  For anyone else having the same issue...

Ran a capture on WireShark and it reveals the EngineID

[Andrew Cooper]

If you can use snmpget then you can use

snmpget -v3 -l authPriv -u USERID - a SHA -A "<SHA_PASSWORD>"   -x AES -X "<AES_PASSWORD>" <hostname> snmpEngineID.0

We had a CSV file of the hostname,sha_password,aes_password and used this to get the EngineID from the 200+ devices in the original list and then do incremental runs when either new devices or old device are updated (use a OS patch can change the EngineID, what fun).  But then we had to individual create the snmptd entries for the actual trap decoding, and then generate trap to see that we got it correct, which also required something like wireshark or local firewall to see the UDP packets arriving as we cound not get snmptd to log invalid traps for v3 (again even more fun).

This is not a project for the faint of heart or done quickly.

Finally our devices were "internal" I dont know how you might deal with a "external" cloud service.  Good luck

Regards, Andrew

Note: we ended up using a Linux based workstation for the "discovery" as the SNMP command-line options were more extensive than Windows

------------------------------
Knows a little about UIM/DXim, AE, Automic
------------------------------