Enable SNMP on a Publisher - Netskope Technical Documentation

Netskope recommends to consume Digital Experience Management metrics for capacity and performance monitoring of your Netskope Publishers.

This section explains how to enable SNMP v3 on a Publisher with Ubuntu 22.04 and edit the firewall to allow external monitoring.

Install Packages

sudo apt-get update
sudo apt-get -y install snmpd libsnmp-dev

Create a Secure SNMPv3 User

Stop the agent first (avoids write-while-running surprises):

sudo systemctl stop snmpd

Create the user (choose strong, different auth/priv passphrases):

sudo net-snmp-config --create-snmpv3-user \
-A '<AuthPassword>' -a SHA \
-X '<PrivPassword>' -x AES \
snmpv3user

snmpv3user: username (keep or change; the rest of this guide uses it)
-a SHA -x AES + -l authPriv (below) gives auth+encryption.

Configure the SNMP Agent

Edit /etc/snmp/snmpd.conf to exactly this minimal, secure config:

# Listen on UDP/161 on all interfaces
agentAddress udp:161

# Read view: allow everything under .1 (tighten later if you want)
view all included .1

# Authorize our v3 user (read-only, authPriv) on that view
rouser snmpv3user authPriv.

# Optional: disk alert trap when / has <2GB free (kB units) 
disk / 2000

# Optional: expose Linux conntrack session count via extend
# (see "About conntrackCount" section below)
extend-sh conntrackCount cat /proc/sys/net/netfilter/nf_conntrack_count

Since the Community Strings for SNMPv1 and SNMPv2c (such as public) are transmitted in plaintext, it is highly recommended that you remove the default configurations to enforce the use of the more secure SNMPv3 protocol.

In the /etc/snmp/snmpd.conf file, delete or comment out (by adding a # at the beginning of the line) the following two lines:

# rocommunity public default -V systemonly # rocommunity6 public default -V systemonly

After removing these lines, all monitoring requests attempting to use the SNMPv1/v2c protocol with the public community string will be rejected. Your monitoring system must be configured to use the SNMPv3 user (like authPrivUser) created in the previous steps to connect.

Notes

We’re not using -V systemonly so you can read IF-MIB, TCP-MIB, UCD-SNMP, etc.
Keep view all .1 while you test; later you can narrow to just the OIDs you need.

Restart and enable:

sudo systemctl restart snmpd
sudo systemctl enable snmpd
sudo systemctl status snmpd --no-pager

Allow SNMPv3 in the Firewall (UFW)

If UFW is enabled, allow UDP/161 from your Network Management System (NMS) only:

sudo ufw allow from <NMS_IP> to any port 161 proto udp
sudo ufw status

Quick End-to-end Tests (from your NMS)

Replace <PUBLISHER_IP> with the Publisher’s IP.

System group (proof SNMPv3 works)

snmpwalk -v3 -l authPriv -u snmpv3user \
  -a SHA -A '<AuthPassword>' -x AES -X '<PrivPassword>' \
  <PUBLISHER_IP>  system

Uptime

snmpget -v3 -l authPriv -u snmpv3user \
  -a SHA -A '<AuthPassword>' -x AES -X '<PrivPassword>' \
  <PUBLISHER_IP>  DISMAN-EVENT-MIB::sysUpTimeInstance

CPU & Memory (UCD-SNMP)
Here are some examples of the OIDs your monitoring may use.

# CPU %
snmpget -v3 -l authPriv -u snmpv3user -a SHA -A '<AuthPassword>' -x AES -X '<PrivPassword>' \
  <PUBLISHER_IP> \
  .1.3.6.1.4.1.2021.11.9.0   \  # pctUser
  .1.3.6.1.4.1.2021.11.10.0  \  # pctSystem
  .1.3.6.1.4.1.2021.11.11.0     # pctIdle

# Memory (kB)
snmpget -v3 -l authPriv -u snmpv3user -a SHA -A '<AuthPassword>' -x AES -X     
 '<PrivPassword>' \
  <PUBLISHER_IP> \
  .1.3.6.1.4.1.2021.4.5.0   \    # memTotal
  .1.3.6.1.4.1.2021.4.6.0       # memAvail

Disk usage by mount (UCD-SNMP dskTable)

snmpwalk -v3 -l authPriv -u snmpv3user -a SHA -A '<AuthPassword>' -x AES -X '<PrivPassword>' \
  <PUBLISHER_IP>  UCD-SNMP-MIB::dskTable

Concurrent TCP sessions (TCP-MIB)
This scalar needs .0:

snmpget -v3 -l authPriv -u snmpv3user -a SHA -A '<AuthPassword>' -x AES -X '<PrivPassword>' \
  <PUBLISHER_IP>  .1.3.6.1.2.1.6.9.0   
# tcpCurrEstab

About conntrackCount (the extend-sh line)

Linux keeps a kernel table of tracked connections (nf_conntrack). The current entry count lives at:

/proc/sys/net/netfilter/nf_conntrack_count

The extend-sh directive runs a command and exposes its output via the NET-SNMP-EXTEND-MIB. In our config:

extend-sh conntrackCount cat /proc/sys/net/netfilter/nf_conntrack_count

This creates an extend entry named conntrackCount. You can read it from any NMS using the nsExtendOutput1Line object:

Symbolic:

NET-SNMP-EXTEND-MIB::nsExtendOutput1Line."conntrackCount"

Numeric OID (same thing):

.1.3.6.1.4.1.8072.1.3.2.3.1.1."conntrackCount"

How to query it (from the NMS)

snmpget -v3 -l authPriv -u snmpv3user \
  -a SHA -A '<AuthPassword>' -x AES -X '<PrivPassword>' \
  <PUBLISHER_IP>  NET-SNMP-EXTEND-MIB::nsExtendOutput1Line."conntrackCount"

Tip

If your NMS reports that it can’t find the MIB, either load the NET-SNMP MIBs on the NMS, or use the numeric OID form above.

Troubleshooting Checklist

No response / timeout
→ Firewall or addressing. Confirm UDP/161 is allowed from the NMS to the Publisher.
→ sudo ss -lun | grep :161 on the Publisher to confirm snmpd is listening.
Authentication failure
→ Username, auth/priv protocols, and both passphrases must match exactly.
→ We use -l authPriv -a SHA -x AES.
No Such Object for TCP/IF/UCD OIDs
→ You accidentally restricted the view (e.g., -V systemonly). Use the view all .1 example above, then tighten later if needed.
conntrackCount missing
→ Ensure the extend-sh conntrackCount ... line is present (no typos), then sudo systemctl restart snmpd.
→ Query using the numeric OID to bypass MIB loading issues:

snmpget -v3 -l authPriv -u snmpv3user -a SHA -A '<AuthPassword>' -x AES -X '<PrivPassword>' \
<PUBLISHER_IP>  .1.3.6.1.4.1.8072.1.3.2.3.1.1."conntrackCount"

Connect to a Publisher using SSH and log in.
On the menu, select 6 and exit to the CLI.
Update all packages (recommended).
```
sudo apt-get update
```

Install SNMP.

sudo apt-get -y install snmpd libsnmp-dev

Configure the agentAddress in the /etc/snmp/snmpd.conf file. Add this line to the file:
```
disk / 10000
```
Stop the snmpd service so you can add a user.
```
sudo service snmpd stop
```

Add an SNMP v3 user.

sudo net-snmp-config --create-snmpv3-user -A <AuthPassword> -X <CryptoPassword> -a <MD5|SHA> -x <AES|DES> <user>

Set up the rouser correctly on /etc/snmp/snmpd.conf by adding rouser authPrivUser authpriv -V systemonly.
Set up the TCP correctly on /etc/snmp/snmpd.conf by replacing agentaddress 127.0.0.1, [::1] with agentaddress udp:161.
Restart the SNMPD service.
```
sudo service snmpd restart
```
Check that SNMPD is started.
```
sudo service snmpd status
```
Verify the firewall (ufw) is running.
```
sudo ufw status
```
Configure UFW to allow connections to SNMPD. The SNMP daemon will listen for connections on port 161.
```
sudo ufw allow in to any port 161 proto udp
```

Verify the SNMP service has been allowed by the firewall permanently and that UDP traffic on Port 161 is allowed.

sudo ufw status Status: active To Action From -- ------ ---- 161/udp ALLOW Anywhere 161/udp (v6) ALLOW Anywhere (v6)

To check if snmpd on the Publisher machine works correctly, check the following:

sudo service snmpd status
snmpd.service - Simple Network Management Protocol (SNMP) Daemon.
Loaded: loaded (/lib/systemd/system/snmpd.service; enabled; vendor preset: enabled)
Active: active (running) since Fri 2024-05-31 07:26:11 UTC; 59min ago
Process: 14823 ExecStartPre=/bin/mkdir -p /var/run/agentx (code=exited, status=0/SUCCESS)
Main PID: 14824 (snmpd)
Tasks: 1 (limit: 1126)
Memory: 5.6M
CGroup: /system.slice/snmpd.service
└─14824 /usr/sbin/snmpd -LOw -u Debian-snmp -g Debian-snmp -I -smux mteTrigger mteTriggerConf -f -p />