Setup of SNMP v3 DTLS/TLS snmptrapd informs and snmpd trapsess in CentOS/RHEL 7 Linux - net-snmp

this tutorial video succeeds my howto on snmpd setup
in TLS/DTLS mode. There is the link:

In CentOS/RHEL 7 Linux we're going to setup SNMP v3 snmptrapd to accept secure TLS/DTLS informs and traps.
We will also modify snmpd to generate trapsess using TLS/DTLS.

List of used commands:
____________
1) Where are we?
cat /etc/centos-release

2) List installed net-snmp RPMs
rpm -qa | grep net-snmp

3) Show available TLS certificates
net-snmp-cert showcerts --fingerprint

5) Add there following lines. We will have to insert
real SHA1 fingerprints as retrieved in step 3
[snmp] localCert {manager certificate}
certSecName 20 {agent certificate} --sn trapuser
authUser log -s tsm trapuser

6) On the manager open /etc/sysconfig/snmptrapd
vim /etc/sysconfig/snmptrapd

7) Add there following lines. We have to enable
snmptrapd to listen
on TLS/DTLS ports. Replace hostnames with your real.

8) On the manager enable snmptrapd and start it
systemctl enable snmptrapd
systemctl start snmptrapd

9) On the manager, monitor /var/log/messages for
new SNMP messages
tail -f /var/log/messages

10) On the agent generate inform message from
commandline. First to DTLS port
snmpinform -v 3 -u trapuser -T our_identity={agent certificate} \
-T their_identity={manager certificate} dtlsudp:{hostname}:10162 42 coldStart.0

It works! Message appeared in the log on the manager node.

11) Now the same with TLS port.
snmpinform -v 3 -u trapuser -T our_identity={agent certificate} \
-T their_identity={manager certificate} tlstcp:{hostname}:10162

Works again! Message arrived too.

12) Informs works.
Now the second part - trapsess - informs generated
by snmpd.

14) Add trapsess DTLS definition
trapsess -T our_identity={agent certificate} -T their_identity={manager certificate} dtlsudp:{hostname}:10162

16) Restart snmpd. Start/stop of snmpd generates trap as well. Watch /var/log/messages
systemctl restart snmpd

[mhrnn]

Could you please do a tutorial on how to configure snmp v3 traps on CentOS/RHEL 7 agent (from snmpd.conf file)? Also great video !

[andreiirtus]

Hi,
where did you get this information, because i can not find anything about traps over dtls? Could you give a link with documentation please?