What's changed: Initial version
4.3SNMP and Syslog
Covers the difference between SNMPv2c (community) and SNMPv3 (authentication and encryption) for monitoring and managing devices, the fire-and-forget trap versus the acknowledged inform, and the severity levels 0-7 (0 emergency to 7 debug) and facility of Syslog—learning to judge, from operational requirements, that a logging trap level captures "that value and everything more severe."
You cannot inspect dozens to hundreds of devices by hand, so in practice you collect status via SNMP and aggregate events onto one log server via Syslog for monitoring. CCNA tests the security difference between SNMP versions and the trap vs. inform distinction, plus the ordering of Syslog severity levels and the meaning of a logging level setting—not as rote memory but as operational judgment about "how far down the severity to send logs."
4.3.1SNMP versions and traps vs. informs
- SNMP is a monitoring protocol by which an NMS (manager) gets/sets a device agent's MIB (management information) and receives notifications from the device. v1/v2c authenticate only with a community string (effectively a plaintext password) and have no encryption, making them weak to eavesdropping. v3 adds authentication (auth) and encryption (priv) (with three levels: noAuthNoPriv/authNoPriv/authPriv), so v3 is recommended where confidentiality is needed.
- Devices notify the NMS of events in two ways: a trap is fire-and-forget and waits for no acknowledgment (lightweight, but not retransmitted if lost in transit). An inform waits for an ack from the NMS and retransmits if it does not arrive (more reliable but generates more traffic; v2c and later). Use inform for important notifications that must be delivered reliably, and trap when lightness matters.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.