SNMP switches

This page gets Ferrule reading managed switches from any maker over SNMP: Cisco, Juniper, Aruba, HPE, MikroTik, Netgear, Dell, Arista and others.

What Ferrule reads: each switch's name, model, software version and uptime; every Ethernet port's link, speed, duplex, traffic, errors and drops, and its description; temperatures and fans where the switch reports them; and what is plugged into each port, from LLDP. What it can't: it changes nothing. It reads only, with a read-only community or user.

The switches appear on the LAN tab beside your UniFi devices, and get the same alerts: offline, rebooted, errors climbing, a port flapping, a link slower than it used to run, half duplex, a hot chassis and a failed fan.

Many switches, one slot

One entry can list many switches that share the same community or SNMPv3 user. Ferrule has eight source slots, so put every switch that shares credentials in one.

Turn on SNMP on each switch

Every switch does this in its own place. Look for SNMP in its web page or its configuration. Turn on read-only access in one of two ways:

• SNMPv2c with a community: a shared word, like a password. Simple, but it travels in plain text.
• SNMPv3 with a user: a user name, an authentication passphrase and a privacy (encryption) passphrase, each at least 8 characters. Choose SHA and AES if the switch offers them.

If the switch can limit SNMP to certain addresses, allow only the Docker host that runs Ferrule.

Two common switches, as an example

On a Cisco IOS switch, a read-only community limited to one host:

access-list 99 permit 192.168.1.10
snmp-server community <community> RO 99

On a Juniper switch, an SNMPv2c read-only community:

set snmp community <community> authorization read-only

Use your switch maker's guide for anything else.

Which should I choose?

SNMPv3 signs and encrypts everything, so it is the better choice if all your switches support it. SNMPv2c is fine on a management network that only your team can reach. Don't use a community anyone else knows, such as public.

Enter it in the setup wizard

On the wizard's What you have page, set SNMP switches to the number of groups you have (switches sharing one community count as one). On its page:

1. Name: what you call the group, such as core.
2. Addresses: every switch's name or IP address, separated by commas, without https://: 192.168.1.2,192.168.1.3. If a switch answers on a port other than 161, add it after a colon: 192.168.1.4:1161.
3. SNMP version: SNMPv2c or SNMPv3.
4. For SNMPv2c, the Community. For SNMPv3, the SNMPv3 user, both passphrases, and the Authentication and Privacy the switch uses.
5. Click Test.

When it works you see ✓ Connected: and what it found, such as 2 switches, 31 ports up. If one switch doesn't answer, Test still connects and says 1 not answering.

Editing the stack by hand

For SNMPv2c, the secret is the community. Write any $ as $$.

SOURCE_3=snmp 192.168.1.2,192.168.1.3 name=core version=2c
SOURCE_3_SECRET=<community>

For SNMPv3, the secret is both passphrases with a colon between them. auth= is sha or md5, priv= is aes or des; leave them off for SHA and AES.

SOURCE_4=snmp 10.0.1.2 name=dc version=3 user=telemetry auth=sha priv=aes
SOURCE_4_SECRET=<authentication passphrase>:<privacy passphrase>

A slot takes up to 64 addresses. See Every variable.

Where it shows up

Each switch is a row on the LAN tab, with an SNMP badge and its maker. Open it for the faceplate: every port, coloured as UniFi ports are. Select a port for its speed, errors, description and the LLDP neighbour plugged into it. Settings → Sources lists the group as polling.

What Ferrule counts as a port

Only physical Ethernet ports. VLAN interfaces, port channels, loopbacks and tunnels are left out. Ports are numbered 1, 2, 3 in the switch's own order; the port's name on the switch, such as Gi1/0/1, is shown beside the number.

Fibre or copper?

No standard SNMP table says whether a port is a fibre cage. Ferrule guesses from the port's name (sfp-sfpplus1, xe-0/1/0, Te1/1/1) and description. If it guesses wrong, only the colour on the faceplate is wrong; every reading and alert is the same. Optic temperature and light levels are not in any standard SNMP table either, so switches read over SNMP don't show them.

If something's wrong

The Docker host must reach each switch on UDP port 161. Firewalls often allow TCP and block UDP.

What you see	What to do
no answer from ...; is SNMPv2c on, is the community right, and is UDP 161 reachable?	A switch ignores a wrong community without a word, so check the community first, then that SNMP is on and UDP 161 is open.
refused SNMPv3: the agent does not know user "telemetry"	Check the user name on the switch.
... wrong authentication passphrase, or the agent does not use SHA	Check the passphrase, or add auth=md5.
... wrong privacy passphrase, or the agent does not use AES	Check the privacy passphrase, or add priv=des.
user= is for SNMPv3	You gave a user with SNMPv2c. Remove it, or choose SNMPv3.
none of the N switches answered	No switch in the list answered: check the credentials and the firewall.
A switch's row says offline	That one switch stopped answering. Its last name stays on the row.
No temperatures or fans	The switch doesn't report them in ENTITY-SENSOR-MIB, the standard table. Ports still work.

See Troubleshooting for more.