1

Basically, I have a small network where my OpenNMS installation is located on a CentOS 6.4 machine.

Now I have a server(CentOS also) that I want to monitor but is on the internet, with a public address.

I have installed net-snmp on my target server and configured /etc/snmp/snmpd.conf

When I try to do

snmpwalk -v 2c -c public localhost

on my target system, it returns the expected output.

But running

snmpwalk -v 2c -c public c******2.com

on my OpenNMS server querying against my target server returns a

Timeout: No Response from c******2.com

I tried turning debug on (snmpwalk -v 2c -c public c******2.com -d) and I got this output:

Sending 42 bytes to UDP: [*.*.*.*]:161->[0.0.0.0]

I wonder what could be the problem?

Update:

This is my config inside snmpd.conf

##sec.name  source          community
com2sec local     localhost       private
com2sec national  x.x.x.x/23  public

##group.name sec.model  sec.name
group MyRWGroup  v2c        local
group MyROGroup  v2c        national

##incl/excl subtree                          mask
view all    included  .1                               80

## -or just the mib2 tree-

view mib2   included  .iso.org.dod.internet.mgmt.mib-2 fc


## context sec.model sec.level prefix read   write  notif
access MyROGroup ""      any       noauth    prefix      all    none   none
access MyRWGroup ""      any       noauth    prefix      all    all    all

disk PATH [MIN=100000]

disk / 10000

load 12 14 14
8
  • Open the firewall? Also post your SNMP server configuration. May 16, 2013 at 22:39
  • 2
    SNMPv2 is one of those insecure protocols that transmit credentials in the clear. You really should not be sending that over the Internet. It should be within a VPN/Tunnel or something.
    – Zoredache
    May 16, 2013 at 22:42
  • @MichaelHampton, I have temporarily turned off iptables on both machine, eventhough I'm sure my firewall rules are fine.
    – Bryan CS
    May 16, 2013 at 22:56
  • Is your IP address within that /23 that you have defined in the configuration? May 16, 2013 at 22:57
  • @Zoredache, yeah I have read of that also. I was thinking about snmp over ssh but I'm not really sure if it's the easiest way. Can you suggest of any other way aside from VPN?
    – Bryan CS
    May 16, 2013 at 22:58

2 Answers 2

1

Here is a problem: You haven't actually allowed snmpd to respond to your connections.

com2sec national  x.x.x.x/23  public

You said that this IP address is the IP of the same server running snmpd, which means that only machines within that /23 will be allowed. This is almost certainly not what you want.

To resolve the issue, use the IP address of the machine(s) which will be sending the SNMP requests. If you have multiple IP addresses you will need multiple com2sec lines here. Or you can just use default and then use the firewall to control access.

4
  • But the machine sending the SNMP request is inside a private network, I am assuming I will use the public address/gateway of my private network then? When you say use the default and use firewall, you mean NAT? Thanks.
    – Bryan CS
    May 16, 2013 at 23:04
  • Right, you have to use the public IP address. May 16, 2013 at 23:05
  • Do I have to do some additional steps like port forwarding on my gateway towards my OpenNMS server?
    – Bryan CS
    May 16, 2013 at 23:12
  • Maybe. Depends on whatever device you have doing NAT. I don't recommend using NAT in this scenario. May 16, 2013 at 23:12
3

Just a suggestion for OpenNMS monitoring.

For my remote OpenNMS systems in locations where I don't have a private line or can't use a LAN-to-LAN VPN tunnel, I take a different approach. I use n2n from ntop to create a peer-to-peer tunnel between systems. This is handy in cases where I don't control the firewall(s) at one side or the other or have complex NATing to work against.

I wouldn't advise sending unencrypted SNMP over the internet, though.

1
  • 2
    While the answer given by Michael Hampton is very correct, the bigger question of whether or not you should be trying to get this to work at all probably more important. I would definitely look in to using some kind of secured tunnel and only allowing SNMP locally and over the tunnel. May 17, 2013 at 2:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .