SNMP Monitoring from Multiple Collectors

RouterOS General
1

I have a device that we monitor that another company also wants to collect information from via SNMP. My immediate thought was to create another Community for the other company and have both active but ofcourse this isn’t possible.

Is the only way to do it on a Mikrotik to have both agents use the same Community credentials and my agent to just have the one community for both companies? I’m not sure if I have misunderstood something but this seems like a bit of an oversight and quite a simple one at that, which is what makes me think it isn’t an oversight and this is how it should work. Could someone please clarify?

2

Can’t you just add a new community?

/snmp community
set [ find default=yes ] read-access=no
add addresses=1.1.1.1/32 name=COMPANY_1
add addresses=2.2.2.2/32 name=COMPANY_2
3

Yeah you can create as many communities as you want but when actually putting them in use under IP > SNMP > Trap Community you can only have 1 active at a time.

4

If they give you multiple trap communities then technically you need multiple source IPs and interfaces so it probably gets more complex than that.

5

You can add multiple source IPs though this is sort of what confuses me. So from my understanding if I wanted to have two separate collectors I would need them to both have the exact same setup which seems strange and somewhat insecure.

6

Probably most users of SNMP use polling rather than traps…
Maybe there exists some software that can work as a trap relay/multiplier? (running on another system or in a container)

7

Say if I wasn’t using traps in that case, how would I set it up so that both collectors can use V3? Because as far as I can tell you can only set the SNMP version under Trap Version. And in doing so you can only define authentication and encryption with a Trap Community.

8

you dont set snmp version under trap. Trap is for traps. You make communities, you just create multiple snmpv3 communities, each one will work

9

So with Mikrotik will all communities be v1 or v2 unless the Auth and Encryption details are entered?

Further to this, that makes more sense, but still how can you have multiple active Communities if you have multiple collectors? And if you can’t what would be the best way of achieving this?

10

Just add the communities you want, they will all be “usable”

/snmp community
set [ find default=yes ] disabled=yes
add addresses=::/0 authentication-password=password authentication-protocol=SHA1 encryption-password=PASSWORD_1 encryption-protocol=AES name=COMPANY_2_V3 security=authorized
add addresses=::/0 authentication-password=password authentication-protocol=SHA1 encryption-password=PASSWORD_2 encryption-protocol=AES name=COMPANY_1_V3 security=authorized
add addresses=::/0 name=SOME_V2_COMMUNITY
add addresses=::/0 name=ANOTHER_V2_COMMUNITY
/snmp
set contact=some@email.com enabled=yes location=MY_LOCATION
11

Managed to work this out but I appreciate the confirmation! I think my confusion came from the fact that you can have as many active communities as you want but you can only have a single trap community active. That still seems strange to me but I’ve got what I need. Thanks! :slight_smile: