Forward DCE events SNMPV3

[timoorda]

Hello,

We have configured forwarding Events to our monitoring system, using "Alarm Configuration" > "Network Management System Intergration" SNMPV3 and we need to get the EngineID to be able to recognize the trpas of the snmpv3 and use the AuthPriv passwords and user to dencrypt the traps.

\

Without the EngineID we can't catch the traps in the monitoring system, we recorded the packets and there is no EngineID.

How we can Get or configure the EngineID to be able to dencrypt the traps?

Thank You.

Regards,

Timoor Dabbour

[Shaun]

Hi @timoorda,

I think it's important to note that this integration uses Informs for snmpv3, not traps.

When sending v3 traps, the authoritative engine is the engine sending the trap.  When sending v3 Informs, the authoritative engine is the engine receiving the Inform.

How this affects what you're looking for here, is that if we were sending a trap, then we should send it with the DCE's engineID.  But when sending it as an Inform, the DCE needs to discover the receiver's engineID.

If your receiver correctly handles Informs, what you should expect to see in the packet packet capture, is:

• DCE -> Receiver: empty get-request, with no auth parameters (engineID, etc)
• Receiver->DCE: report usmStatsUnknownEngineIDs, but this response has an engineID set
• DCE -> Receiver: informRequest, using the engineID from the previous report
• Receiver->DCE: get-response, with the same oids as the informRequest sent - this just acknowledges receipt.

I've attached a sample of this; the IP ending 78 is a DCE sending a test from the "Network Management System Integration" dialog, and the IP ending 51 is snmptrapd acting as the receiver.  If you want to decrypt the encryptedPDU fields, the paramaters are sha1:secretpassword & aes:secretpassword.

[timoorda]

Hello @Shaun ,

Appreciate Your Response

We will check if the monitoring system can handle this snmp infroms.

We wanted to use "Alarm Action" from Device Alarm Configurations tab in addition to the other way to send events

How we can get the Engine ID in that case ?

And if we need another MIBS and not only the Powernet MIBS ?

Thank You.

Best Regards,

Timoor Dabbour