SNMP Through CSS

Answered Question
Apr 24th, 2010
User Badges:

I read that SNMP is not a mapped as flows on CSS by default. Thus, I can't see SNMP traffic via "flow statics".


I have SW's behind CSS's setup as services, and my SNMP server cannot reach to the SW's that are behind the CSS.


circuit VLAN803

  ip address 192.168.213.3 255.255.255.0
    ip virtual-router 213 preempt
    ...
    ip redundant-vip 213 192.168.213.251
    ip redundant-vip 213 192.168.213.252


circuit VLAN50
  ip address 192.168.50.14 255.255.255.0
    ip virtual-router 50 preempt
    ip redundant-interface 50 192.168.50.15

    ....


service SW1
  ip address 192.168.50.251
  active
service SW2
  ip address 192.168.50.252
  active


owner ABC
  ...
  content SSW1
    vip address 192.168.213.251
    add service SW1
    active
  content SSW2
    vip address 192.168.213.252
    add service SW2
    active


Should I just remove the SW IP's as services and permit SNMP server to reach the real IP (i.e., no NAT)?


Or do I enable SNMP flows (i.e., flow-state 161 udp flow-enable)?

Correct Answer by Sean Merrow about 7 years 6 days ago

Hello,


With the example config you posted, you really aren't load balancing anyway, since you have only one service per VIP.  Therefore, it seems like it would be simpler to just let the server connect directly to the real IP addresses of the two SNMP hosts through the CSS.  The CSS will simply route or switch the UDP packets as necessary.


Unless I'm missing something, using the VIPs is just adding unnecessary complexity.


Hope this helps,

Sean

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
Sean Merrow Mon, 04/26/2010 - 11:13
User Badges:
  • Silver, 250 points or more

Hello,


With the example config you posted, you really aren't load balancing anyway, since you have only one service per VIP.  Therefore, it seems like it would be simpler to just let the server connect directly to the real IP addresses of the two SNMP hosts through the CSS.  The CSS will simply route or switch the UDP packets as necessary.


Unless I'm missing something, using the VIPs is just adding unnecessary complexity.


Hope this helps,

Sean

normanzhang Mon, 04/26/2010 - 11:39
User Badges:

I agree completely. I will hit the real IP instead. Thanks.

Actions

This Discussion