Netgate snmp vs. net-snmp

Overlord

Hey guys

Today I played around with the Netgate snmp service and the package net-snmp for pFsense. The normal function works fine, but unfortunately they have SNMP v2 only. I want to have it more secures with SNMP v3.

I figured out, that the net-snmp package sent's less OIDs than the pfSense function - in lines snmp 7070 vs. net-snmp 4465.

I think the SNMP modules like MibII are not loaded. How can I load them for the net-snmp package?

Greetz
Ovrld

jimp

The built-in SNMP is bsnmpd which has a dedicated pf module. That's the only set of OIDs which wouldn't be available with net-snmp since it doesn't have a module for pf info. There isn't a way to get that information in net-snmp natively.

Overlord

@jimp said in Netgate snmp vs. net-snmp:

The built-in SNMP is bsnmpd which has a dedicated pf module. That's the only set of OIDs which wouldn't be available with net-snmp since it doesn't have a module for pf info. There isn't a way to get that information in net-snmp natively.

Thank you for answer - is there any possibility, that the integrated snmp function get an SNMP v3 support someday?

jimp

It's unlikely. There is support for it in the bsnmpd daemon but since it's already fully implemented in the net-snmp, there is not much motivation to work on the base version since it is not as capable as net-snmpd (which may eventually replace bsnmpd)

Overlord

@jimp said in Netgate snmp vs. net-snmp:

It's unlikely. There is support for it in the bsnmpd daemon but since it's already fully implemented in the net-snmp, there is not much motivation to work on the base version since it is not as capable as net-snmpd (which may eventually replace bsnmpd)

I could be that I understand it wrong - but with snmp I can't have a secured connection and with net-snmp I have, but I can't have all modules loaded?

jimp

The only information not available in net-snmp is pf-related information, which is not a missing/not loaded module, it just isn't capable of reading it.

Overlord

Mhm I tried with check_mk and with snmp I got a lot of information like all virtual interfaces. With the net-snmp I got less information - no virtual interfaces. But it could be, that the virtual interfaces are stored in that pf-related information.

Edit
I have another question: With net-snmp I get information about the filesystem - with snmp not. Is it not possible for the snmp to read the information?

Sergei_Shablovsky

@jimp said in Netgate snmp vs. net-snmp:

The only information not available in net-snmp is pf-related information, which is not a missing/not loaded module, it just isn't capable of reading it.

Is any changes in this situation?

jimp

No.

Sergei_Shablovsky

@jimp said in Netgate snmp vs. net-snmp:

No.

Thank You for answering.

So, is this mean that Netgate company not see the SNMP monitoring (even on own-branded devices) as critical (because health of main firewall = health of all infrastructure of certain organizations) ?

P.S. BTW what system for real-time Monitoring You use for 5-10G pfSense connection?

jimp

There are two methods to get SNMP data. pf data is only available in one of them. It's not up to us to determine which SNMP packages support pf data, that's up to the authors of the SNMP daemons.

We may eventually add SNMPv3 to bsnmpd if it's viable.

But at no time does any of that even come close to implying what you are trying to twist it to mean.

Sergei_Shablovsky

@jimp ok, thank You for explaining.

Sergei_Shablovsky

@jimp P.S. BTW what system for real-time Monitoring You use for 5-10G pfSense device?