Skip to content

2.1 Network Management

Jump to bottom
echadbourne edited this page Jan 30, 2024 · 9 revisions

Notes

APIPA - The windows default IP, means that you have a DHCP client that does not have access to a DHCP server

  • Ex. 169.254.x.x

Network Management Lab

The prerequisites for this lab included all of the previous setup we have done, as well as setting up web01 without joining it to the domain

Firewall Setup

The first thing we had to do was enable the SNMP services on the pfSense firewall, I used the GUI and accessed the SMNP service page through the "services" drop down menu. From there I was able to set up the SNMP service on the firewall, using:

  • Polling port 161
  • Set up a community string
  • Bind it to the LAN interface

Then I restarted the SNMP service with the restart button at the top

Nmon01

I had to go through the basic setup the same as web01 for nmon, setting the IP address to the one seen in the IP address entry. To install snmp services I used the command:

  • sudo yum install net-snmp-utils

Then I queried the firewall with snmpwalk -Os -c [community string] -v2c fw01-elizabeth system

Web01 SNMP server

For this I had to use the command: sudo yum install net-snmp-utils net-snmp

Next, while preserving the original config file, I made a new /etc/snmp/snmpd.conf with the following lines the only thing in it:

  • com2sec myNetwork 10.0.5.0/24 [community string]
  • group myROGroup v2c myNetwork
  • view all included .1 80
  • access myROGroup "" any noauth exact all none none

Saved the file, enabled and started the snmpd with systemctl enable snmpd and systemctl start snmpd, also checked the status. Next I needed to let the port through the firewall with

  • firewall-cmd --permanent --add-port=161/udp
  • firewall-cmd reload
  • firewall-cmd --query-port=161/udp - used to check port status, came back "yes"

I then queried web01 from nmon with snmpwalk -Os -c [community string] -v2c web01-elizabeth system

SNMP on AD and MGMT

Next I needed to add snmp tools to AD and MGMT, both were features

  • MGMT got SNMP-Tools under remote administration
  • AD got SNMP Service Feature

At first I did not have all of the things checked that I needed to, so I had to go back and install more things, but it did eventually work

To enable remote management on AD I had to use powershell (on AD, from MGMT) with the following command:

  • Set-NetFirewallRule -DisplayGroup "Remote Event Log Management" -Enabled True - This edits the firewall rules so I can manage AD from MGMT with Computer Manager

SNMP Service Security Properties on AD

Using Computer Management for AD, under services, I had to find the SNMP service and go to the security tab.

  • Add [community string] to the accepted community names
  • Change the "accept SNMP packets from this host" to only have nmon's hostname listed (nmon01-elizabeth)

Then restart the service

Query AD from NMON to test

TCPdump

You are able to capture SNMP packets between a client and network manager using tcpdump. In order to illustrate this, I used the command:

  • tcpdump -i ens192 port 161 -c10 -AAA - this tells the computer to listen on interface ens192 and port 161, capture the first 10 packets, and display the output in ASCII text so you can read it

Running a SNMP query from nmon01 to web01 will then display the packets on web01, which leaves the community string in plaintext since it is in plaintext in the packet.

Research

Below is the research I did on 3 topics from todays class

SNMP Expanded

Since I still didn't fully understand SNMP I decided to research it a little more so I could understand it better. I found the Simple Network Management Protocol is an Application Layer protocol in the OSI Model, which is layer 7. It most commonly uses UDP, which is faster but does not provide error-checking when moving data. SNMP can do many things regarding the configuration of networks, and some of the ones I wanted to expand upon are:

  • Set Request - can set a specific configuration on the client computer, this includes sending commands to the client as well
  • GetNext Requests - sent to agent to find the values of the next record in MIB hierarchy
  • GetBulk Request - Sends multiple GetNexts to retrieve tables of data

I found it interesting that SNMP can be used to retrieve more than management data, it can also be used to configure specific things on clients

In addition, there are 4 pieces to the use of SNMP (This was not clear to me):

  1. Managed Device - Self Explanatory
  2. SNMP Agent - The software that runs on the managed devices, this is what collects the data
  3. SNMP Manager/Server - Management station. Actively "requests agents send SNMP updates at regular intervals"
  4. MIB - More on this later

Source: https://www.thousandeyes.com/learning/techtorials/snmp-simple-network-management-protocol#:~:text=Simple%20Network%20Management%20Protocol%20(SNMP,devices%20in%20Internet%20Protocol%20networks.

MIB Expanded

I am still not super clear on what a Management Information Base (MIB) really is, which is why I am trying to figure that out

MIB is a "data structure" that is a text file (with the .mib extension) that "describes all data objects used by a particular device that can be queried or controlled using SNMP including access control" (thousandeyes.com). According to DPS telecom, its purpose is to "translate numerical strings into human readable text." It uses Object Identifiers (OIDs) to do this, which are expanded upon later.

Sources:

OIDs Expanded

Object Identifiers, or OIDs, are unique identifiers for all of the computers in an SNMP management system. I was not clear on whether OIDs represented computers or the data on the computers, like CPU temp, but it looks like its the computers - almost like an IP address, but a different kind of address for a different protocol.

OIDs are strings of numbers, like 1.3.6.1.4.1.x.x.x.x.x.x.x.x.x.x, and each of those numbers means something. The MIB helps you decode what each of those means, but essential each one represents a part of identifying information for the computer, like manufacturer and other stuff. I didn't go into all of the specifics on the website I found, but that gave me a general idea of how this all works.

Source: https://www.dpstele.com/snmp/what-does-oid-network-elements.php

Clone this wiki locally