snmp
Use the following commands to configure SNMP related settings.
snmp community
Use this command to configure SNMP communities on your FortiAnalyzer unit.
You add SNMP communities so that SNMP managers, typically applications running on computers to monitor SNMP status information, can connect to the FortiAnalyzer unit (the SNMP agent) to view system information and receive SNMP traps. SNMP traps are triggered when system events happen such as when there is a system restart, or when the log disk is almost full.
You can add up to three SNMP communities, and each community can have a different configuration for SNMP queries and traps. Each community can be configured to monitor the FortiAnalyzer unit for a different set of events.
Hosts are the SNMP managers that make up this SNMP community. Host information includes the IPv4 address and interface that connects it to the FortiAnalyzer unit.
For more information on SNMP traps and variables, see the Fortinet Document Library.
|
Part of configuring an SNMP manager is to list it as a host in a community on the FortiAnalyzer unit that it will be monitoring. Otherwise that SNMP manager will not receive any traps or events from the FortiAnalyzer unit, and will be unable to query the FortiAnalyzer unit as well. |
Syntax
config system snmp community
edit <index_number>
set events <events_list>
set name <community_name>
set query-v1-port <integer>
set query-v1-status {enable | disable}
set query-v2c-port <integer>
set query-v2c-status {enable | disable}
set status {enable | disable}
set trap-v1-rport <integer>
set trap-v1-status {enable | disable}
set trap-v2c-rport <integer>
set trap-v2c-status {enable | disable}
config hosts
edit <host_number>
set interface <interface_name>
set ip <ipv4_address>
end
config hosts6
edit <host_number>
set interface <interface_name>
set ip <ipv6_address>
end
end
Example
This example shows how to add a new SNMP community named SNMP_Com1. The default configuration can be used in most cases with only a few modifications. In the example below the community is added, given a name, and then because this community is for an SNMP manager that is SNMP v1 compatible, all v2c functionality is disabled. After the community is configured the SNMP manager, or host, is added. The SNMP manager IPv4 address is 192.168.20.34 and it connects to the FortiAnalyzer unit internal interface.
config system snmp community
edit 1
set name SNMP_Com1
set query-v2c-status disable
set trap-v2c-status disable
config hosts
edit 1
set interface internal
set ip 192.168.10.34
end
end
snmp sysinfo
Use this command to enable the FortiAnalyzer SNMP agent and to enter basic system information used by the SNMP agent. Enter information about the FortiAnalyzer unit to identify it. When your SNMP manager receives traps from the FortiAnalyzer unit, you will know which unit sent the information. Some SNMP traps indicate high CPU usage, log full, or low memory.
For more information on SNMP traps and variables, see the Fortinet Document Library.
Syntax
config system snmp sysinfo
set contact-info <string>
set description <description>
set engine-id <string>
set fortianalyzer-legacy-sysoid <string>
set location <location>
set status {enable | disable}
set trap-cpu-high-exclude-nice-threshold <percentage>
set trap-high-cpu-threshold <percentage>
set trap-low-memory-threshold <percentage>
end
|
Variable |
Description |
|---|---|
|
contact-info <string> |
Add the contact information for the person responsible for this FortiAnalyzer unit (character limit = 255). |
|
description <description> |
Add a name or description of the FortiManager unit (character limit = 255). |
|
engine-id <string> |
Local SNMP engine ID string (character limit = 24). |
|
fortianalyzer-legacy-sysoid <string> |
Enable to switch back to legacy FortiAnalyzer sysObjectOID (default = disable).. |
|
location <location> |
Describe the physical location of the FortiAnalyzer unit (character limit = 255). |
|
status {enable | disable} |
Enable/disable the FortiAnalyzer SNMP agent (default = disable). |
|
trap-cpu-high-exclude-nice-threshold <percentage> |
SNMP trap for CPU usage threshold (excluding NICE processes), in percent (default = 80). |
|
trap-high-cpu-threshold <percentage> |
SNMP trap for CPU usage threshold, in percent (default = 80). |
|
trap-low-memory-threshold <percentage> |
SNMP trap for memory usage threshold, in percent (default = 80). |
Example
This example shows how to enable the FortiAnalyzer SNMP agent and add basic SNMP information.
config system snmp sysinfo
set status enable
set contact-info 'System Admin ext 245'
set description 'Internal network unit'
set location 'Server Room A121'
end
snmp user
Use this command to configure SNMPv3 users on your FortiAnalyzer unit. To use SNMPv3, you will first need to enable the FortiAnalyzer SNMP agent. For more information, see snmp sysinfo. There should be a corresponding configuration on the SNMP server in order to query to or receive traps from FortiAnalyzer.
For more information on SNMP traps and variables, see the Fortinet Document Library.
Syntax
config system snmp user
edit <name>
set auth-proto {md5 | sha}
set auth-pwd <passwd>
set events <events_list>
set notify-hosts <ipv4_address>
set notify-hosts6 <ipv6_address>
set priv-proto {aes | des}
set priv-pwd <passwd>
set queries {enable | disable}
set query-port <integer>
set security-level {auth-no-priv | auth-priv | no-auth-no-priv}
end
end
