Configuring SNMP on pfsense

[iptvcld]

Is there an existing issue for this?

• I have searched the existing open and closed issues

Am I willing to test this? 🧪

• I will do my best to test this feature on the netlertx-dev image when requested within 48h and report bugs to help deliver a great user experience for everyone and not to break existing installations.

Can I help implement this? 👩‍💻👨‍💻

• Yes
• No

Is your feature request related to a problem? Please describe

If a device connects and then disconnects then we won’t be alerted of the scan does not occur

Describe the solution you'd like

Real time scan maybe look at dhcp logs of pfsense

Describe alternatives you've considered

Warpath

Anything else?

No

[jokob-sk]

Hi @iptvcld ,

You can already adjust the scan window to be e.g. every minute via Settings. If taht's insufficient, you can try is to create a custom plugin to continuously scan in a separate thread and the results would be then processed in given intervals.

This way you would never miss a device. Disconnections may still be missed (if a device disconnects and reconnects, let's say within a minute), but I think discovering of new devices is more important.

If you are happy to help out, I can try incorporating continuous scanning, why you try to create a pfsense plugin, if you have some time. Here is a walkthrough of creating a custom plugin:

[jokob-sk]

Actually - I just realized SNMP is supported on pfsense, so you can try the SNMP plugin if it already works. If yes, and the 1 minute interval is still too long, I can try to incorporate continuous background scanning. Let me know how you go.

[iptvcld]

Thanks for the reply. I can try snmp but I think continuously scanning may get in the way of pfsense internal scans that occur. But I am not sure what pfsense sends for snmp dhcp responses because let’s say I have the scan at 5 mins can this tool check past connections and then just alert on any new connects. I don’t need instant but just something that tells me some device connected and it may be not be online but I have a record of it

[jokob-sk]

This then depends on what information is available via SNMP. If past entries are, then yes 👍

[iptvcld]

And will this tool know how to read the Mac and IP and format the notification?

[jokob-sk]

yes :)

[iptvcld]

I just enabled SNMP on pfsense and then enabled the option on netalertX and updated the iP to my router - but no devices are being found

22:09:22 [2024-07-01 22:09:22-04:00] START Run: SNMPDSC
22:09:22 [Plugins] Executing: python3 /app/front/plugins/snmp_discovery/script.py routers={s-quote}{routers}{s-quote}
22:09:22 [SNMPDSC] In script
22:09:22 [SNMPDSC] Router snmpwalk command: snmpwalk -v 2c -c public -OXsq 192.168.2.80 .1.3.6.1.2.1.3.1.1.2
22:09:22 [SNMPDSC] output: mib-2.3.1.1.2 No Such Object available on this agent at this OID

22:09:22 [SNMPDSC] Entries found: 0
22:09:22 [Plugins] No output received from the plugin SNMPDSC - enable LOG_LEVEL=debug and check logs
22:09:22 [2024-07-01 22:09:22-04:00] END Run: SNMPDSC

[jokob-sk]

Hi!

I think this is not an issue with NetAlertX, but with the command or agent configuration. This is what I got out of ChatGPT:

The "No Such Object available on this agent at this OID" error in SNMP usually means that the specific OID (Object Identifier) you are querying does not exist or is not available on the SNMP agent you are querying.

Here are a few steps to troubleshoot this issue:

Verify the OID:
    Make sure that the OID you are querying is correct and exists on the SNMP agent. Double-check the documentation for the device or software you are querying.

SNMP Version Compatibility:
    Ensure that the SNMP version you are using (SNMPv1, SNMPv2c, SNMPv3) is supported by the agent and that you are using the correct version in your query.

Access Control:
    Check the SNMP access control settings on the agent. It might be configured to restrict access to certain OIDs based on community strings or user credentials.
    For SNMPv3, ensure that the user has the necessary permissions to access the OID.

MIBs:
    Make sure you have the correct MIBs (Management Information Bases) loaded that define the OIDs. Without the correct MIBs, your SNMP tools may not be able to resolve OIDs properly.

SNMP Walk:
    Perform an SNMP walk starting from a higher-level OID to see what OIDs are available on the agent. This can help you identify if the OID you are querying is indeed present.
    Example command using snmpwalk:

    sh

    snmpwalk -v2c -c public 192.168.1.1 .1

Agent Configuration:
    Ensure the SNMP agent is properly configured to expose the OIDs you are trying to query. This might involve editing the SNMP configuration file on the device.

Check Logs:
    Check the SNMP agent's logs for any error messages or indications of why the OID is not available.

Here is an example of querying an SNMP agent with snmpget:

sh

snmpget -v2c -c public 192.168.1.1 .1.3.6.1.2.1.1.1.0

Replace public with your community string, 192.168.1.1 with the IP address of your SNMP agent, and .1.3.6.1.2.1.1.1.0 with your target OID.

[jokob-sk]

Here is the chat history if you'd like to follow up: https://chatgpt.com/share/4f43da10-f66e-40f8-a10d-50b245b9f12d

[iptvcld]

Thanks; i have enabled it pfsense correct and on netalertX - i have enabled SNMP, updated the IP for the walk and ran the scan - but nothing. Maybe something to do with auth to pfsense, there are no fields for the username and password

[jokob-sk]

you can also ssh into the container or any terminal and try if your command works - I regrettably don't have pfsense running, but try to troubleshoot with that chatgpt instance and if you get the command running in the terminal, you should be able to use it in netalertx

[iptvcld]

ok, i will have a chat with GPT - this is the result using terminal
c9f5de0051e7:/# snmpget -v2c -c public 192.168.2.80 .1.3.6.1.2.1.1.1.0
SNMPv2-MIB::sysDescr.0 = STRING: pfSense pfadmin.servernode.com 2.7.2-RELEASE FreeBSD 14.0-CURRENT amd64

[jokob-sk]

as per the docs, the expected output should look something like this for NAX to ingest it properly:

Expected output (ingestion) in format:

 iso.3.6.1.2.1.3.1.1.2.3.1.192.168.1.2 "6C 6C 6C 6C 6C 6C "
 iso.3.6.1.3.1.3.1.1.2.3.1.192.168.1.3 "7C 6C 6C 6C 6C 6C "
 iso.3.6.1.4.1.3.1.1.2.3.1.192.168.1.4 "8C 6C 6C 6C 6C 6C "
...etc