Documentation
VyOS Documentation
VyOS Services
SNMP Monitoring in VyOS

SNMP Monitoring in VyOS

SNMP provides monitoring and management of network equipment. VyOS supports SNMP v1, v2c, and v3, allowing you to integrate the router with monitoring systems (Nagios, Zabbix, PRTG, LibreNMS) and collect metrics on performance, interface status, and other parameters.

Overview

What is SNMP

Simple Network Management Protocol:

  • A protocol for monitoring network devices
  • Metrics collection (CPU, memory, bandwidth, interfaces)
  • Alerts via SNMP traps
  • Standardized MIBs (Management Information Base)

SNMP Versions

SNMPv1:

  • The base version
  • Community strings for authentication
  • Not encrypted
  • Legacy, but widely supported

SNMPv2c:

  • Improved performance
  • Community strings
  • Bulk operations
  • Not encrypted
  • The most widely used version

SNMPv3:

  • Authentication and encryption
  • User-based security
  • Recommended for production
  • More complex configuration

SNMP Components

Agent:

  • Runs on VyOS
  • Responds to SNMP requests
  • Sends traps

Manager (NMS - Network Management System):

  • Monitoring system (Zabbix, Nagios, etc.)
  • Issues SNMP queries
  • Receives traps

MIB (Management Information Base):

  • A database of objects
  • OID (Object Identifier) - a unique ID
  • Standard MIBs (IF-MIB, HOST-RESOURCES-MIB, etc.)

SNMP Operations

  • GET - retrieve the value of an OID
  • GETNEXT - retrieve the next OID
  • GETBULK - retrieve multiple OIDs (SNMPv2c/v3)
  • SET - set a value (dangerous, usually disabled)
  • TRAP - an asynchronous notification from the agent

Basic Configuration

SNMPv2c (simple configuration)

# Community string (read-only)
set service snmp community public authorization ro

# Allow access from the monitoring server
set service snmp community public network 192.168.1.0/24

# Location and contact
set service snmp location 'Data Center - Rack A12'
set service snmp contact 'admin@company.com'

# Listen address
set service snmp listen-address 0.0.0.0 port 161

commit
save

Verifying SNMP

# Check the service on VyOS
show service snmp

# From the monitoring server
snmpwalk -v2c -c public 192.168.1.1

# Specific OID (system description)
snmpget -v2c -c public 192.168.1.1 1.3.6.1.2.1.1.1.0

SNMPv3 (secure)

# User with authentication and encryption
set service snmp v3 user monitor auth type md5
set service snmp v3 user monitor auth plaintext-password 'AuthPassword123!'
set service snmp v3 user monitor privacy type aes
set service snmp v3 user monitor privacy plaintext-password 'PrivPassword456!'

# Security level
set service snmp v3 user monitor mode ro

# View (restricting MIB access)
set service snmp v3 view default oid 1.3.6.1

# Group
set service snmp v3 group monitoring mode ro
set service snmp v3 group monitoring view default

# User in a group
set service snmp v3 user monitor group monitoring

# Listen
set service snmp listen-address 0.0.0.0 port 161

commit
save

SNMPv3 test:

snmpwalk -v3 -l authPriv -u monitor \
  -a MD5 -A 'AuthPassword123!' \
  -x AES -X 'PrivPassword456!' \
  192.168.1.1

Communities (SNMPv1/v2c)

Read-only Community

# Public community (do not use in production!)
set service snmp community public authorization ro
set service snmp community public network 192.168.1.0/24

# Private community (better)
set service snmp community SecretMonitoring authorization ro
set service snmp community SecretMonitoring network 192.168.1.100/32

commit

Read-write Community

# Read-write (dangerous!)
set service snmp community admin authorization rw
set service snmp community admin network 192.168.1.100/32

commit

Warning: RW access allows the configuration to be modified through SNMP SET. Use it with caution.

Multiple Communities

# Monitoring system
set service snmp community zabbix authorization ro
set service snmp community zabbix network 192.168.1.100/32

# Backup monitoring
set service snmp community nagios authorization ro
set service snmp community nagios network 192.168.1.101/32

# Management network
set service snmp community private authorization ro
set service snmp community private network 10.0.0.0/8

commit

SNMPv3 Configuration

Users and Authentication

# User 1: MD5 auth, AES encryption
set service snmp v3 user monitor1 auth type md5
set service snmp v3 user monitor1 auth plaintext-password 'StrongAuth1!'
set service snmp v3 user monitor1 privacy type aes
set service snmp v3 user monitor1 privacy plaintext-password 'StrongPriv1!'
set service snmp v3 user monitor1 mode ro

# User 2: SHA auth, DES encryption
set service snmp v3 user monitor2 auth type sha
set service snmp v3 user monitor2 auth plaintext-password 'StrongAuth2!'
set service snmp v3 user monitor2 privacy type des
set service snmp v3 user monitor2 privacy plaintext-password 'StrongPriv2!'
set service snmp v3 user monitor2 mode ro

commit

Views (restricting MIB access)

# Default view (the entire MIB tree)
set service snmp v3 view default oid 1.3.6.1

# Limited view (interfaces only)
set service snmp v3 view interfaces-only oid 1.3.6.1.2.1.2

# System view
set service snmp v3 view system-only oid 1.3.6.1.2.1.1

commit

Groups

# Monitoring group
set service snmp v3 group monitoring mode ro
set service snmp v3 group monitoring view default

# Admin group (read-write)
set service snmp v3 group admin mode rw
set service snmp v3 group admin view default

# Assign users to groups
set service snmp v3 user monitor1 group monitoring
set service snmp v3 user admin1 group admin

commit

Security Levels

noAuthNoPriv - no authentication, no encryption:

set service snmp v3 user public mode ro
# Do not use in production

authNoPriv - authentication, no encryption:

set service snmp v3 user monitor auth type md5
set service snmp v3 user monitor auth plaintext-password 'AuthPass!'
set service snmp v3 user monitor mode ro
# Privacy is not configured

authPriv - authentication and encryption (recommended):

set service snmp v3 user secure auth type sha
set service snmp v3 user secure auth plaintext-password 'AuthPass!'
set service snmp v3 user secure privacy type aes
set service snmp v3 user secure privacy plaintext-password 'PrivPass!'
set service snmp v3 user secure mode ro

SNMP Traps

Trap Configuration

# Trap target (monitoring server)
set service snmp trap-target 192.168.1.100 community 'trapCommunity'
set service snmp trap-target 192.168.1.100 port 162

# SNMPv3 trap
set service snmp v3 trap-target 192.168.1.100 user trapuser
set service snmp v3 trap-target 192.168.1.100 auth type md5
set service snmp v3 trap-target 192.168.1.100 auth plaintext-password 'TrapAuth!'
set service snmp v3 trap-target 192.168.1.100 privacy type aes
set service snmp v3 trap-target 192.168.1.100 privacy plaintext-password 'TrapPriv!'

commit

Trap Triggers

VyOS automatically sends traps for:

  • Link up/down events
  • Cold start (router reboot)
  • Authentication failures

Listen Configuration

Listen Addresses

# Listen on all interfaces
set service snmp listen-address 0.0.0.0 port 161

# Or specific interfaces
set service snmp listen-address 192.168.1.1 port 161
set service snmp listen-address 10.0.0.1 port 161

# IPv6
set service snmp listen-address ::0 port 161

commit

Custom Port

# Non-standard port (security through obscurity)
set service snmp listen-address 0.0.0.0 port 10161

commit

Note: Most NMS platforms expect port 161.

Common OIDs

System Information

# System description
1.3.6.1.2.1.1.1.0

# System uptime
1.3.6.1.2.1.1.3.0

# System contact
1.3.6.1.2.1.1.4.0

# System name (hostname)
1.3.6.1.2.1.1.5.0

# System location
1.3.6.1.2.1.1.6.0

Interfaces

# Interface table
1.3.6.1.2.1.2.2

# Interface names
1.3.6.1.2.1.31.1.1.1.1

# Interface status (up/down)
1.3.6.1.2.1.2.2.1.8

# Interface speed
1.3.6.1.2.1.2.2.1.5

# Interface in octets (RX)
1.3.6.1.2.1.2.2.1.10

# Interface out octets (TX)
1.3.6.1.2.1.2.2.1.16

CPU and Memory

# CPU usage (HOST-RESOURCES-MIB)
1.3.6.1.2.1.25.3.3.1.2

# Memory total
1.3.6.1.2.1.25.2.2.0

# Memory used
1.3.6.1.4.1.2021.4.6.0

Storage

# Disk usage
1.3.6.1.4.1.2021.9.1.9

# Disk percentage
1.3.6.1.4.1.2021.9.1.9

Integration with Monitoring Systems

Zabbix

SNMP template for VyOS:

  1. Zabbix → Configuration → Hosts → Create host
  2. Host name: vyos-router
  3. Groups: Network devices
  4. Interfaces: SNMP
    • IP: 192.168.1.1
    • Port: 161
    • SNMP version: SNMPv2
    • SNMP community: {$SNMP_COMMUNITY}
  5. Templates: Link template
    • Template Net Network Generic Device SNMP
    • Template Module Interfaces SNMP

Macros:

{$SNMP_COMMUNITY} = SecretMonitoring
{$IF_ERRORS_WARN} = 2
{$BANDWIDTH_WARN} = 80

Custom items:

Name: CPU Usage
Type: SNMP agent
Key: system.cpu.util
SNMP OID: 1.3.6.1.4.1.2021.11.9.0
Type of information: Numeric (float)
Units: %

Nagios

SNMP checks:

# Install the plugin
apt-get install nagios-plugins-snmp

# Check interface status
/usr/lib/nagios/plugins/check_snmp -H 192.168.1.1 \
  -C public \
  -o 1.3.6.1.2.1.2.2.1.8.2 \
  -r 1 -m RFC1213-MIB

# Check CPU
/usr/lib/nagios/plugins/check_snmp -H 192.168.1.1 \
  -C public \
  -o 1.3.6.1.4.1.2021.11.9.0 \
  -w 80 -c 90

# Check bandwidth
/usr/lib/nagios/plugins/check_snmp -H 192.168.1.1 \
  -C public \
  -o 1.3.6.1.2.1.2.2.1.10.2 \
  -w 100000000 -c 150000000

Nagios config (/etc/nagios/objects/vyos.cfg):

define host{
    use                     generic-switch
    host_name               vyos-router
    alias                   VyOS Router
    address                 192.168.1.1
    _snmp_community         public
}

define service{
    use                     generic-service
    host_name               vyos-router
    service_description     SNMP - CPU Usage
    check_command           check_snmp_cpu!80!90
}

LibreNMS

Add device:

  1. Devices → Add Device
  2. Hostname: 192.168.1.1
  3. SNMP Version: v2c
  4. Community: SecretMonitoring
  5. Port: 161
  6. Add Device

LibreNMS automatically discovers:

  • Interfaces
  • VLANs
  • Routing protocols
  • System metrics

SNMPv3 in LibreNMS:

SNMP Version: v3
Auth Level: authPriv
Auth User: monitor
Auth Password: AuthPassword123!
Crypto: AES
Crypto Password: PrivPassword456!

PRTG

SNMP Traffic sensor:

  1. Add Sensor → SNMP Traffic Sensor
  2. Device: VyOS Router
  3. SNMP Version: v2c
  4. Community String: public
  5. Interface: eth0
  6. Traffic Mode: Use interface counters
  7. Add Sensor

Custom SNMP sensor:

  1. Add Sensor → SNMP Custom
  2. OID: 1.3.6.1.4.1.2021.11.9.0 (CPU)
  3. Sensor name: CPU Usage
  4. Unit: Percent

Prometheus + SNMP Exporter

snmp.yml:

auths:
  public_v2:
    community: public
    security_level: noAuthNoPriv
    version: 2

modules:
  vyos:
    walk:
      - 1.3.6.1.2.1.1    # System
      - 1.3.6.1.2.1.2    # Interfaces
      - 1.3.6.1.4.1.2021 # UCD-SNMP-MIB
    metrics:
      - name: sysUpTime
        oid: 1.3.6.1.2.1.1.3
        type: gauge
      - name: ifInOctets
        oid: 1.3.6.1.2.1.2.2.1.10
        type: counter

Prometheus config:

scrape_configs:
  - job_name: 'snmp'
    static_configs:
      - targets:
        - 192.168.1.1
    metrics_path: /snmp
    params:
      module: [vyos]
    relabel_configs:
      - source_labels: [__address__]
        target_label: __param_target
      - source_labels: [__param_target]
        target_label: instance
      - target_label: __address__
        replacement: localhost:9116

Monitoring and Diagnostics

Checking the SNMP Service

# Service status
show service snmp

# SNMP daemon status
systemctl status snmpd

# Listening ports
netstat -ulnp | grep 161

SNMP Tools on VyOS

# snmpwalk (retrieve all OIDs)
snmpwalk -v2c -c public localhost

# snmpget (specific OID)
snmpget -v2c -c public localhost 1.3.6.1.2.1.1.5.0

# snmpbulkwalk (faster for large MIBs)
snmpbulkwalk -v2c -c public localhost

Debugging

# SNMP logs
show log | grep snmp

# Detailed snmpd log
cat /var/log/snmpd.log

# Test from remote
snmpwalk -v2c -c public -d 192.168.1.1

Performance Monitoring

# SNMP request rate
watch -n 1 'netstat -s | grep -i snmp'

# Bandwidth via SNMP
snmpget -v2c -c public 192.168.1.1 1.3.6.1.2.1.2.2.1.10.2
# Repeat and calculate the delta

Troubleshooting

SNMP Not Responding

Problem: SNMP queries time out.

Causes:

  1. The SNMP service is not running
  2. A firewall is blocking UDP 161
  3. Wrong community string
  4. The listen address is incorrect

Diagnostics:

# Check the service
show service snmp

# Check whether it is listening
netstat -ulnp | grep 161

# Firewall
show firewall ipv4 input filter

# Test locally
snmpget -v2c -c public localhost 1.3.6.1.2.1.1.5.0

Solution:

# Enable SNMP
set service snmp community public authorization ro
set service snmp listen-address 0.0.0.0 port 161

# Firewall
set firewall ipv4 input filter rule 50 action accept
set firewall ipv4 input filter rule 50 source address 192.168.1.0/24
set firewall ipv4 input filter rule 50 destination port 161
set firewall ipv4 input filter rule 50 protocol udp

commit

SNMPv3 Authentication Failed

Problem: “Authentication failure” for SNMPv3.

Causes:

  1. Wrong username/password
  2. Auth type mismatch
  3. Security level mismatch

Diagnostics:

# Check users
show service snmp v3

# Test with verbose output
snmpwalk -v3 -l authPriv -u monitor \
  -a MD5 -A 'WrongPassword' \
  -x AES -X 'PrivPassword' \
  -d 192.168.1.1

Solution:

# Check passwords
show configuration service snmp v3 user monitor

# Recreate the user
delete service snmp v3 user monitor
set service snmp v3 user monitor auth type md5
set service snmp v3 user monitor auth plaintext-password 'CorrectAuthPass!'
set service snmp v3 user monitor privacy type aes
set service snmp v3 user monitor privacy plaintext-password 'CorrectPrivPass!'

commit

Community String Does Not Work

Problem: “No Such Name” or timeout.

Causes:

  1. The community does not exist
  2. A network restriction is blocking access
  3. The authorization type is incorrect

Solution:

# Check communities
show configuration service snmp community

# Add a network
set service snmp community public network 192.168.1.0/24

# Or allow all (not recommended)
set service snmp community public network 0.0.0.0/0

commit

Traps Not Arriving

Problem: The monitoring server does not receive traps.

Causes:

  1. The trap target is not configured
  2. A firewall on the NMS is blocking UDP 162
  3. Wrong community string

Solution:

# Configure the trap
set service snmp trap-target 192.168.1.100 community 'trapCommunity'
set service snmp trap-target 192.168.1.100 port 162

# Test the trap
snmptrap -v2c -c trapCommunity 192.168.1.100 '' \
  1.3.6.1.6.3.1.1.5.3 \
  1.3.6.1.2.1.1.5.0 s "Test Trap"

commit

OID Returns No Data

Problem: A specific OID returns “No Such Object”.

Causes:

  1. The OID does not exist
  2. A view restriction is blocking access
  3. The feature is not enabled

Solution:

# Walk the MIB to find the OID
snmpwalk -v2c -c public localhost | grep -i cpu

# Check view restrictions
show configuration service snmp v3 view

# Enable the necessary MIBs
# VyOS supports standard MIBs by default

Security

Security Recommendations

  1. Use SNMPv3:
set service snmp v3 user secure auth type sha
set service snmp v3 user secure auth plaintext-password 'StrongAuth!'
set service snmp v3 user secure privacy type aes
set service snmp v3 user secure privacy plaintext-password 'StrongPriv!'
  1. Strong community strings:
# Do not use 'public' or 'private'
set service snmp community H8kL2mP9qR4sT7v authorization ro
  1. Network restrictions:
# Only from monitoring servers
set service snmp community secure network 192.168.1.100/32
set service snmp community secure network 192.168.1.101/32
  1. Firewall:
set firewall ipv4 input filter rule 50 action accept
set firewall ipv4 input filter rule 50 source address 192.168.1.100/32
set firewall ipv4 input filter rule 50 destination port 161
set firewall ipv4 input filter rule 50 protocol udp
  1. Read-only access:
# Avoid RW communities
set service snmp community monitor authorization ro
  1. Specific listen address:
# Do not listen on the WAN
set service snmp listen-address 192.168.1.1 port 161
  1. Views for SNMPv3:
# Restrict access to sensitive OIDs
set service snmp v3 view limited oid 1.3.6.1.2.1.2
set service snmp v3 group monitoring view limited
  1. Rate limiting:
set firewall ipv4 input filter rule 50 recent count 10
set firewall ipv4 input filter rule 50 recent time minute 1
  1. Logging:
# Monitor SNMP access
show log | grep snmp
  1. Regular audits:
    • Review communities
    • Check access logs
    • Update passwords

Configuration Examples

Example 1: Basic monitoring (SNMPv2c)

# Community for Zabbix
set service snmp community zabbix authorization ro
set service snmp community zabbix network 192.168.1.100/32

# System info
set service snmp location 'Main Office - Server Room'
set service snmp contact 'netadmin@company.com'

# Listen
set service snmp listen-address 0.0.0.0 port 161

# Firewall
set firewall ipv4 input filter rule 50 action accept
set firewall ipv4 input filter rule 50 source address 192.168.1.100/32
set firewall ipv4 input filter rule 50 destination port 161
set firewall ipv4 input filter rule 50 protocol udp

commit
save

Example 2: Enterprise SNMPv3

# SNMPv3 users
set service snmp v3 user monitor auth type sha
set service snmp v3 user monitor auth plaintext-password 'MonitorAuth2024!'
set service snmp v3 user monitor privacy type aes
set service snmp v3 user monitor privacy plaintext-password 'MonitorPriv2024!'
set service snmp v3 user monitor mode ro

# View
set service snmp v3 view monitoring oid 1.3.6.1

# Group
set service snmp v3 group monitoring-group mode ro
set service snmp v3 group monitoring-group view monitoring

# Assign
set service snmp v3 user monitor group monitoring-group

# Trap
set service snmp v3 trap-target 192.168.1.100 user monitor
set service snmp v3 trap-target 192.168.1.100 auth type sha
set service snmp v3 trap-target 192.168.1.100 auth plaintext-password 'TrapAuth!'
set service snmp v3 trap-target 192.168.1.100 privacy type aes
set service snmp v3 trap-target 192.168.1.100 privacy plaintext-password 'TrapPriv!'

# System
set service snmp location 'Data Center A - Rack 12'
set service snmp contact 'noc@enterprise.com'

# Listen
set service snmp listen-address 10.0.0.1 port 161

commit
save

Example 3: Multi-NMS environment

# Zabbix
set service snmp community zabbix authorization ro
set service snmp community zabbix network 192.168.1.100/32

# Nagios
set service snmp community nagios authorization ro
set service snmp community nagios network 192.168.1.101/32

# PRTG
set service snmp community prtg authorization ro
set service snmp community prtg network 192.168.1.102/32

# Management
set service snmp community mgmt authorization ro
set service snmp community mgmt network 10.0.0.0/8

# Traps for all
set service snmp trap-target 192.168.1.100 community 'trapCommunity'
set service snmp trap-target 192.168.1.101 community 'trapCommunity'
set service snmp trap-target 192.168.1.102 community 'trapCommunity'

# System
set service snmp location 'Branch Office'
set service snmp contact 'admin@branch.com'

set service snmp listen-address 0.0.0.0 port 161

commit
save

Best Practices

  1. SNMPv3 for production:

    • Authentication and encryption
    • User-based access control

  2. Strong credentials:

    • Community strings: 20+ characters
    • SNMPv3 passwords: 12+ characters

  3. Network restrictions:

    • Specific monitoring server IPs
    • Do not allow 0.0.0.0/0

  4. Read-only access:

    • RW only if absolutely necessary
    • Restrict RW to specific OIDs

  5. Firewall protection:

    • Allow only monitoring servers
    • Rate limiting

  6. Regular monitoring:

    • Check SNMP performance
    • Review access logs
    • Monitor for authentication failures

  7. Documentation:

    • Document communities/users
    • NMS configurations
    • Custom OID mappings

  8. Testing:

    • Test after configuration
    • Verify that all OIDs are accessible
    • Test traps

  9. Backup:

    • Document SNMP credentials separately
    • Include them in the disaster recovery plan

  10. Keep updated:

    • Regular password rotation
    • Update NMS templates
    • Review and clean up unused communities

Conclusion

SNMP in VyOS provides a powerful tool for monitoring and managing network infrastructure. Key capabilities:

  • SNMPv1/v2c/v3 support - compatibility with all NMS platforms
  • Standard MIBs - IF-MIB, HOST-RESOURCES-MIB, UCD-SNMP-MIB
  • Traps - asynchronous notifications
  • Security - SNMPv3 with authentication and encryption

Use SNMP for:

  • Bandwidth monitoring
  • Interface status tracking
  • CPU/Memory monitoring
  • Alerting via traps
  • Integration with enterprise NMS

Proper SNMP configuration provides visibility into network infrastructure and enables proactive monitoring and troubleshooting.

Reviewed by OpenNix LLC · Last updated on
LLDP (Link Layer Discovery Protocol) in VyOSTFTP Server in VyOS