Manually configure WCS as an SNMP Trap Receiver?

If I discover a WLC through the WCS, do I still need to manually configure the WCS as an SNMP trap receiver on the WLC?

The WCS machine must be configured as an SNMP trap receiver to have full management functionality through the WCS.

Similar Messages

Configure WCS to limit SNMP Trap to only Rogue AP alert

Hello all,
Is there a way to limit SNMP traps sent by WCS to only Rogue AP Alert? I know I can configure WCS to send email notification for Rogue AP Alert, but couldn't find anything similar for SNMP traps.
Also, where can I find WCS MIBS and OID for Rogue AP Alert?
Thanks.

https://tools.cisco.com/bugsearch/bug/CSCue09354 may be this is root of problem, when I use native vlan on access port WLC can found rogue ap on wired network... but i use version 7.4.121

SNMP Traps Received are Incorrect

Hello,
I am running SCOM 2012 R2 and I have setup SNMP to receive traps from my HP Procurve switches. All my switches were bought at different times so they have different revisions. I opened a thread about this before, but it was not answered and has
died off so I figured I'd open a new one. If I connect to a switch and view the logs, they come out correctly. The entries would read "Port #19 is now off-line". That same entry in SCOM would read "19". I configured
the same switch to send traps to my PC and I used a simple SNMP trap receiver and the alerts were correct. I was told to update the firmware so I did. But even the switches with the latest firmware show up incorrect in SCOM. Does anyone know
how to fix this issue? HP said to update the MIB's on my management server, but you cannot do that with SCOM. The picture shows a PUTTY session and the logs are displayed correctly. The second picture is the app on my PC and the one on the
bottom is from SCOM:

Hello,
I did some more research and I found out that if I configure my switches to send all traps instead of critical, Not-info, or informs, then the traps are sent correctly. EXCEPT for any "Warning" labeled traps. Any trap that is "Port
#19 is now on-Line" will come through fine, because it's an informational alert. However, the alert "Excessive broadcasts on port #19" that is labeled as a warning comes in as only "19". So it looks like SCOM cannot decipher
a warning alert, but has no problem reading informational alerts. Please respond.

Configuring SNMP Trap receiver on AIP-SSM sensor

I receive the following error message from my ASA5520 firewall when attempting to forward SNMP traps from my AIP-SSM20 sensor to a server on my Inside interface that is configured to receive SNMP traps:
ASA-4-418001: Through-the-device packet to/from management-only network is denied: udp src management: 10.3.21.2/32768 dst Inside: PPC0ES/162
Can I reconfigure the management IP address of the AIP-SSM sensor to connect to the Inside interface instead of the management vlan or does my SNMP server have to reside on the management vlan with the sensor?

Hi Subodh,
Yes, the AIP-SSM can operate in either inline (IPS) or promiscuous (IDS) mode. I would recommend you start by reviewing the following config guide, which shows you how to configure the ASA to pass traffic to the SSM for inspection:
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807335ca.shtml
If you have any other specific questions, feel free to post back.
Hope that helps.
-Mike

Added a Northbound SNMP Trap Receiver in Cisco PI 1.3, but not getting traps

Hi;
I tried going into the Administration, System Settings, Notification Receivers menu and adding a receiver. The receiver was our Zenoss 4.2.3 Resource Manager system. Zenoss has no problems receiving traps from IOS devices such as switches; that is routine for us. For example, we see snmpTrap_Linkdown events from 2960s,etc.
However, even with all the possible events and severities checked in the PI GUI for the receiver, we did not get anything.
As a quick test I added my desktop computer as a receiver and ran Wireshark. Nothing comes through from Cisco PI.
This is supposed to be UDP 162 stuff, so there ought not be a need for a handshake or need to permit anything on the receiver side. I would expect to see a total fire-hose of traps after the receiver is added. But that reasoning conflicts with the need to set the SNMP Community string for the Notification Receiver...
I downloaded the logs from Cisco PI and grepped through all of them for the IPs & names of the test receivers, but found no messages.
Any idea what might be wrong? Do I need to restart something after adding the receiver?
I did notice that even if I supply a ficticious IP and name for the receiver, after it is added the "Operational Status" still says "Up" ...
I sure wish NCS came with a better help system - I can't find anything in the Cisco config guides that explains what a "Northbound" receiver is.
So confused,
Steve

Hi Matt, thanks for taking the time to reply.
>> Not sure why you are trying to do this with PI, this is really more of an ISE function
We don't have ISE and won't be getting it ... still trying to afford the > $100K for PI licenses. Our Content Filter vendor suggested using PI.
>>Is PI set to forward traps for client authentication?
I have all traps and severities checked. Not sure last week nothing showed up in Wireshark. Today I am seeing some UDP info from PI hitting my test workstation. However, when I associate and dissassociate my laptop, nothing comes through. Most of what I see are rogue notifications.
>> Are the controllers that PI is managing also set to forward the same traps?
In Configure,Controllers, , Management, TrapControl, all possible boxes are checked.
>> Is PI configured correctly to forward the traps you want?
Please see answer above.
>> Does your content filter have the right MIBs to decipher the traps correctly?
The content filter vendor says they will customize their software as needed, but the first step is to see traps getting forwarded, and right now, it appeards that PI is not forwarding what I would expect from the GUI settings. Let's worry about MIB stuff after we are getting the raw trap data.
Thanks,
Steve
Message was edited by: Stephen Crye, elaborated & provided latest info.

Simple Free SNMP Trap receiving software.

   I just need a simple trap receiver (Windows XP compatible) for my home network. I have downloaded at least 15 different free products or trials and none of them have worked for me. I'm looking for something that is v3 compatible. Could someone look at my config as well to make sure it looks alright?
I filtered that traps out of the output, but traps have been enabled with snmp-server enable traps:
snmp-server group dmckibbin v3 priv match exact
snmp-server ifindex persist
snmp-server trap-source Loopback0
snmp-server source-interface informs Loopback0
snmp-server location ******************
snmp-server contact *******************
snmp-server host 172.16.1.66 inform version 3 priv dmckibbin
groupname: dmckibbin                        security model:v3 priv
readview : v1default                        writeview: <no writeview specified>
notifyview: *tv.FFFFFFFF.FFFFFFFF.FFFFFFFF0F
row status: active
User name: dmckibbin
Engine ID: 800000090300000D28E2C681
storage-type: nonvolatile        active access-list: SNMP_Access
Authentication Protocol: MD5
Privacy Protocol: DES
Group-name: dmckibbin
Standard IP access list SNMP_Access
    10 permit 172.16.1.66 (65238 matches)
Thanks,
Daniel

Well, free and simple, I like net-snmp's snmptrapd (http://net-snmp.sf.net). I have never used it with Windows, though. MG-SOFT offers a nice Windows trap receiver, but it isn't free (see http://www.mg-soft.si/tringer.html). You can download and eval, however.
The config looks okay. You don't need the "match exact" at the end of the group config, though. Note, if you're going to use informs, you need to configure the SNMP manager's engineID as a remote engineID on your device. With informs, the manager's engine is authoritative.

Remove SNMP trap receiver in CatOS

I've done the Cisco search and came up empty. I used to know this. Isn't there a hidden remove command? Version is CatOs 8.4.1. Hopefully one of you can save the day. TIA!

How about:
clear snmp trap all
or
clear snmp trap

Can a WLC have multiple SNMP Trap Receivers with the same cummunity string?

My Monitoring team want me to send traps to three different trap collectors with the same SNMP Community string.
I have 2106's, 2504, 4400's, 5500's, 7510 all running either version 6 or 7.
Is this possible on a Wireless controller? If so, how?

Read this from my friends blog ..
http://mrncciew.com/2013/02/14/configuring-snmp-on-wlc/
"Also you can configure SNMP trap receiver where WLC can send its snmp trap messages. Community Name means SNMP trap receiver name & that does not have any significance like snmp community value."
It doesnt appear to have the same significants .. But I havent tested it
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

LMS 3.2.1 integration with Clarity NMS for snmp trap forwarding

Our client have integrated Clarity NMS to Ciscoworks LMS 3.2.1. So far they are receiving raw alarms/snmp traps but it lacks information/inventory of the originating device. Kindly see sample raw alarms below:
2420: 2011-11-25 12:10:46 Received trap ==> Received SNMPv1 Trap
Community=ciscoworks
Enterprise=1.3.6.1.6.3.1.1.5
Generip trap type=2
Specific Trap Type=0
Trap From=10.220.10.1
Trap ID=1.3.6.1.6.3.1.1.5.2
Trap Time=-1436283373
1.3.6.1.2.1.2.2.1.1.83=83
1.3.6.1.2.1.2.2.1.2.83=GigabitEthernet1/40
1.3.6.1.2.1.2.2.1.3.83=6
1.3.6.1.4.1.9.2.2.1.1.20.83=Lost Carrier
EndTrap
10933: 2011-11-24 11:57:53 Received trap ==> Received SNMPv1 Trap
Community=ciscoworks
Enterprise=1.3.6.1.4.1.9.1.291
Generip trap type=2
Specific Trap Type=0
Trap From=10.220.10.1
Trap ID=1.3.6.1.4.1.9.1.291.2
Trap Time=1628056965
1.3.6.1.2.1.2.2.1.1.8=8
1.3.6.1.2.1.2.2.1.2.8=E1 0/0/0
1.3.6.1.2.1.2.2.1.3.8=18
EndTrap
As you can see, those raw alarms doesn’t contain any information about the originating equipment or the physical card, port related information where those alarms were generated. Instead those alarms received are just NMS level alarms.
How do we resolve this so that the inventory of the equipment would be part of the trap to be received by Clarity from Ciscoworks.

Hi,
Is the issue you have the source IP address of the forwarded trap? Per RFC it is the IP of the actual device sending the trap. The originating IP should be contained within the packet. I have included some additional information you may find helpful.
Q. What is the difference between SNMP Raw Trap Forwarding and SNMP Trap alert/event Trap Forwarding? Does DFM support both?
A. You can configure raw trap forwarding at DFM > Other configuration > SNMP Trap forwarding, and processed event/alert trap forwarding at DFM > Notification Services > SNMP Trap Forwarding. Processed trap is "when DFM receives certain SNMP traps, it analyzes the data found in fields (Enterprise/Generic trap identifier/Specific Trap identifier/variable−bindings) of each SNMP trap message, and changes the property value of the object property (if required)". Raw trap is the trap that the device forwards to DFM and DFM has yet to process it. For more information, refer to the DFM User Guide. Yes, DFM supports both ways of trap forwarding.
http://www.cisco.com/en/US/products/sw/cscowork/ps2421/products_qanda_item09186a0080a9b35b.shtml
DFM will only forward SNMP traps from devices in the DFM inventory. It will not change the trap format—it will forward the raw trap in the format in which the trap was received from the device. However, you must enable SNMP on your devices and you must do one of the following:
Configure SNMP to send traps directly to DFM
Integrate SNMP trap receiving with an NMS or a trap daemon
The versions of SNMP traps supported by DFM are described in SNMP and ICMP Polling. For information on forwarding processed and pass-through traps, see Processed and Pass-Through Traps, and Unidentified Traps and Events.
Pass-through traps are traps that DFM receives from devices that are not in the DFM inventory, and DFM has not processed. Forwarding these traps is controlled using Configuration > Other Configurations > SNMP Trap Forwarding. These traps are shown in the Alerts and Activities display because of their relevance to fault monitoring. Pass-through traps are displayed as follows:
As one of the following events:
> InformAlarm
> MinorAlarm
> MajorAlarm
With the device type and the device name from which it was generated.
If DFM does not know which device generated the trap, it ignores the trap. Pass-through traps will be cleared after a default interval of 10 minutes to one hour
http://www.cisco.com/en/US/docs/net_mgmt/ciscoworks_device_fault_manager/3.2/user/guide/dfm32ug_Book.html

Re-routing of SNMP traps from port 162 to port greater than 1024

Hello,
I have to re-route SNMP traps received at port 162 to some other port greater that 1024 (say 2041). There is an application which sends SNMP traps to port 162 and our application running on Windows listens for SNMP traps on port 2041, so we want
to route/forward the traps internally from port 162 to 2041.
I have been looking at the rules defined in 'Windows Firewall with advanced security' but not able to succeed. I noticed that there is a predefined rule for SNMP traps but it does not give me an option to forward the trap to another port. I tried
creating a new rule but that also does not give me an option to change the port.
Please help.

Hi,
According to Technet Library:
SNMP uses the default UDP port 161 for general SNMP messages and UDP port 162 for SNMP trap messages. If these ports are being used by another protocol or service, you can change the settings by modifying the local Services file on the agent. The Services
file is located in \ % SystemRoot %\System32\Drivers\Etc
There is no file name extension. You can use any text - based editor to modify the file. The management system must also be configured to listen and send on the new ports.
Caution:
If you have previously configured IP security to encrypt SNMP messages on the default ports, you must also update the IP security policy with the new port settings. Otherwise, communication can be erroneously blocked or SNMP communications might not be secured.
You can access to the link below for this article:
http://technet.microsoft.com/en-us/library/cc959643.aspx
Roger Lu
TechNet Community Support

What is the minimum server layer OEM version supports SNMP trap reception ?

Hi:
- I have been trying to enable SNMP trap reception on an OEM plug-in.
- I turned on debug channel for recvlets.snmp and saw:
2009-10-16 16:07:42,808 Thread-3028552624 ERROR recvlets.snmp: Duplicate threshold : test900, oracle_guide, interfaces, status
and
2009-10-16 16:09:08,382 Thread-3021634480 INFO recvlets.snmp: Trap received is to convert Data Point
2009-10-16 16:09:08,379 Thread-3021634480 INFO recvlets.snmp: Sending Data Point ...
2009-10-16 16:09:08,379 Thread-3021634480 INFO recvlets.snmp: Listening for TRAP
So, it looks like the OEM agent can receive traps but no data point or alert appears.
And, the agent always issues an error about duplicate thresholds.
- Does the agent have to be patched ?
My agent is:
Oracle Enterprise Manager 10g Release 5 Grid Control 10.2.0.5.0.
Copyright (c) 1996, 2009 Oracle Corporation. All rights reserved.
Agent Version : 10.2.0.5.0
OMS Version : 10.2.0.1.0
Protocol Version : 10.2.0.0.0
Agent is Running and Ready
- on the server layer, the oms is:
Oracle Enterprise Manager 10g Release 10.2.0.1.0
Copyright (c) 1996, 2005 Oracle Corporation. All rights reserved.
Oracle Management Server is Up.
Is a patch needed for OMS ?
Should OMS be version 10.2.0.5.0 ?
Thanks
John
Edited by: user8826739 on Feb 23, 2010 7:17 AM

10.2.0.5 should be fine ...
Dave

Generate SNMP Traps report from LMS database

Hi Experts,
Just wondering how LMS handle all SNMP traps received by LMS? Are the traps keep into a database on the server? Is there a way to extract them out as a report?
Regards,
Yi Shyuan

Hello,
Thank you for your answer, unfortunately this isn't what I was looking for.
My idea was to generate fake-positives traps to test efficiently our NMS station.
Traps that I would like to tests would be Temperature, Fan, Board.
I found that chaning the yellow level of the temp sensor to the lower threshold can provide some start point, but I would like to ensure when a real event arrives that my NMS will react accordingly.
Thanks

Cisco Prime SNMP Traps Best Pratice

The Cisco Prime documentation recommends configuring switches to send SNMP traps. However it does not give any more details.
I was wondering what sorts of SNMP traps people in the community are using with Cisco Prime 2.1. I'm looking for some sort of best practice or for an idea of what traps would be the most useful to configure on the switches, to send to Prime.

Hi ,
Snmp traps need to be configured only on device end , there is no config need to be done on PI.
you can enable all the traps that you want. for e.g
snmp-server enable traps syslog
snmp-server enable traps ipsec start stop
snmp-server enable traps memory-threshold
snmp-server enable traps interface-threshold
snmp-server enable traps connection-limit-reached
snmp-server enable traps cpu threshold rising
etc......
and you can monitor then in PI (Administration > System Settings > Severity Configuration, Link down)
check the below link as well:
https://supportforums.cisco.com/discussion/11919481/prime-infrastructure-20-link-status-alarms
Thanks-
Afroz
***Ratings Encourages Contributors ***

SNMP Traps Other Than Switches

Hello,
I am running SCOM 2012 R2 and I have had SNMP traps enabled for a long time now. I have only been monitoring my switches, but now I want to monitor other devices such as UPS's and printers. I followed the article "How the heck do I
get it working?" and I have no issues receiving traps from my switches. But my printer, a Lexmark E260DN sends traps to my P.C. and I am using a free SNMP trap receiver. It sends the traps to my SCOM server too, using the same app. But
SCOM does not display them. My UPS, an APC Smart-UPS 5000, is only discovered using ICMP. I tried discovering it using SNMPV1 and SNMPv3. Both versions result in the same way. I get "No Response SNMP". It is definately
not a firewall issue. I have 35 other devices that are sending me traps. 34 of them are switches and the other one is the printer I just discovered. Any help would be appreciated.

Hi,
You may check Network Discovery Progress Events found in the Monitoring space
under “Operations Manager\Network Discovery\Network Discovery Progress Events”. Network Tracing may help also.
In addition, please refer to the article below to troubleshoot network device discovery issues:
http://www.code4ward.net/main/Blog/tabid/70/EntryId/105/Troubleshooting-Network-Discovery-in-SCOM-2012.aspx
Regards,
Yan Li
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

127.0.0.1 IP address in SNMP trap

Hi,
In Weblogic 9.1, SNMP trap agent address is being sent as 127.0.0.1 IP address. Did anyone see this issue ?
Please let me know how this can be fixed
Thanks --GR

Patch needed - CR278615:
DIAGNOSIS: In the SNMP traps being sent out by WLS, the agent ID always comes out 127.0.0.1. If the trap listener was on a remote machine as the WLS server was, it wouldnt make much sense.
RESOLUTION: Initialize the agent address from the server's configuration.
RELEASE NOTE: SNMP trap data sent out by WebLogic Server Traps used to carry the local loopback address (127.0.0.1) of the SNMP agent machine, that is, the admininstration server machine - instead of its actual network IP address. This problem has been resolved.

Manually configure WCS as an SNMP Trap Receiver?

Similar Messages

Maybe you are looking for