SNMP Traps HP Aruba Switches

[nathanplatt]

Hi Everyone,

I'm trying to configure my 2930F to send logs to NLS, at the moment all the devices are on the same network and not blocked by any firewalls etc... but NLS isn't recieving anything.

I've screenshot the Aruba config... any ideas?

[cdienger]

What's the input(https://www.elastic.co/guide/en/logstas ... ptrap.html) look like on the NLS side? Is port 162 open on the NLS side(netstat -na | grep 162)? Do you see the traps coming in on NLS(yum -y install tcpdump; tcpdump -i any port 162)? Port 162 is considered a privledged port and would need additional configuration to be opened(https://assets.nagios.com/downloads/nag ... Server.pdf).

[nathanplatt]

I've changed the logstat to root but still not recieving anything

[cdienger]

What does the input config look like?

Is port 162 open?

Do you see any incoming traffic on port 162?

[nathanplatt]

Where do i find that?

[cdienger]

An snmptrap input needs to be created under Configure > Global > Global Config > Inputs, before NLS will be able to accept traps.

[nathanplatt]

What would i have to put in their? Also i've noticed someone trying to access it from another IP, is there a way to tell NLS to only accept commands from certain IP's?

[cdienger]

To have it listen on port 162 for incoming traps:

snmptrap {
port => '162'
}

Other config options are covered in https://www.elastic.co/guide/en/logstas ... ptrap-port.

You can restrict access to the machine from others using iptables. iptables is outside the scope of NLS but there is a ton of information on the web regarding it - https://www.linode.com/docs/security/fi ... -iptables/ is a nice into to it.

[nathanplatt]

Worked perfectly! All resolved now