Cisco Certified Network Associate (CCNA) 200-301 · Free study guide

Objective 4.4 — Explain SNMP operations

Simple Network Management Protocol exposes structured device state to monitoring systems and can deliver event notifications. It is a management protocol, not the database or dashboard that operators ultimately view.

Managers and agents

An SNMP manager initiates queries or receives notifications. An agent on the managed device exposes variables and responds according to access policy. A management information base describes the hierarchy and meaning of managed objects. An object identifier names a location in that hierarchy.

The MIB is a schema or definition; actual values come from the agent. Loading a MIB into a manager improves interpretation but does not enable device access by itself.

Polling operations

Get operations retrieve object values. A manager can walk a subtree to collect a related set. Set operations modify writable objects and therefore require much stricter authorization and operational caution. Poll intervals trade freshness against device and network load. Counter wrap, reset, and sampling intervals must be handled when calculating rates.

Traps and informs

An agent can send a trap when an event occurs without waiting for the next poll. A trap is not application-layer acknowledged in the same way an inform is, so delivery characteristics differ. Notifications complement polling: a missed trap should not make long-lived bad state invisible forever.

Security generations

Older community-string designs provide limited protection and can expose clear credentials or data. SNMPv3 can provide user-based authentication and privacy when configured appropriately. Regardless of version, restrict management sources, grant only required access, protect credentials, and monitor use.

Worked scenario

A monitoring platform graphs interface utilization every five minutes and needs immediate notice when a power supply fails. Poll interface octet counters and calculate rate over time; configure a supported notification for the supply event. Use secure SNMP access and still poll supply state so a lost notification does not hide the persistent fault.

Verification

From an authorized manager, query a known read-only object, verify identity and access scope, inspect device SNMP counters or logs, and test notification delivery to the intended collector. Confirm timestamps and device naming for correlation.

Common traps

• Calling the MIB the live value store.
• Treating traps as a replacement for polling.
• Enabling write access for read-only monitoring.
• Ignoring counter interval and wrap.
• Exposing management service to untrusted sources.

Readiness checklist

• I can identify manager, agent, MIB, and OID roles.
• I can compare polling and notifications.
• I understand get, set, trap, and inform at a high level.
• I include secure access and verification.