18.07.2013 Views

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

SNMP and <strong>Sidewinder</strong> <strong>G2</strong><br />

14-4 Configuring the SNMP Agent<br />

<strong>Sidewinder</strong> <strong>G2</strong> SNMP traps<br />

An SNMP trap is an alert message that is sent as an unsolicited<br />

transmission <strong>of</strong> information from a managed node (router, <strong>Sidewinder</strong><br />

<strong>G2</strong>, etc.) to a management station. Most management stations can be<br />

configured to either: (1) display received traps in a pop-up window,<br />

or (2) automatically dial a phone number; such as a pager number.<br />

The <strong>Sidewinder</strong> <strong>G2</strong> SNMP agent supports a basic trap, called the<br />

ColdStart trap, that is sent whenever the SNMP agent in the <strong>Sidewinder</strong><br />

<strong>G2</strong> is enabled. It is also sent if the SNMP configuration file<br />

(/etc/sidewinder/snmp/snmpd.conf) is modified by the Admin<br />

Console.<br />

Note: You cannot disable the ColdStart trap.<br />

You also have the option to configure the <strong>Sidewinder</strong> <strong>G2</strong> to send<br />

audit alarm SNMP traps when an audit event triggers an alarm in the<br />

<strong>Sidewinder</strong> <strong>G2</strong>. Pre-defined alarm events in the <strong>Sidewinder</strong> <strong>G2</strong> are<br />

contained in the 200 range (for example, 201, 202). You also have the<br />

option to create your own custom traps as well. Custom traps will<br />

return messages that contain numbers 215–225. For a list <strong>of</strong> available<br />

SNMP traps, see the<br />

cf snmptrap man page.<br />

To configure the <strong>Sidewinder</strong> <strong>G2</strong> to send the following pre-defined<br />

traps, refer to “Configuring alarm events and event responses” on<br />

page 17-1.<br />

ATTACK_ATTEMPT—This trap is sent when an attack attempt (that is,<br />

any suspicious occurrence) is identified by one <strong>of</strong> the services on<br />

the <strong>Sidewinder</strong> <strong>G2</strong>. For example, if the Network Services Sentry<br />

(NSS) detects a suspicious IP address on an incoming connection,<br />

it will issue an attack attempt trap.<br />

FAILOVER_EVENT—This trap is sent any time a <strong>Sidewinder</strong> <strong>G2</strong><br />

changes its status in an HA cluster from secondary to primary, or<br />

from primary to secondary.<br />

MAIL_FILTER_FAILURE—This trap is sent when SMTP mail messages<br />

fail a configured mail filter. For example, if a mail message failed<br />

the Key Word Search filter, a mail filter failure event would be<br />

logged.<br />

Note: The mail filter map configuration determines what is done with failed<br />

messages.

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!