JuniperConfig226 downloads

Juniper JunOS SNMP v3 and Syslog

SNMPv3 with authentication and privacy, SNMP client lists for source restriction, structured syslog to remote collectors, and NTP - the monitoring baseline for any JunOS device.

↓ example.txt

What is it?

SNMP and syslog are the two halves of knowing what a device is doing. SNMP is pull-based: a monitoring system polls the device for counters like interface utilisation, CPU and temperature. Syslog is push-based: the device sends events as they happen - a link going down, someone logging in, a configuration being committed. JunOS configures both under the `system` and `snmp` hierarchies. SNMPv3 is the only version worth deploying, because v1 and v2c send their community string in cleartext, which makes it a password anyone on the path can read.

When to use

·Every production device, without exception - this is day-one configuration alongside the base config
·Capacity planning: interface counters polled over time are what tell you when a link needs upgrading
·Incident response: `interactive-commands` logging is the record of who typed what and when
·Compliance: most frameworks require centralised logging with a defined retention period
·Alerting on link state and BGP transitions via traps, which arrive faster than the next poll cycle would

When NOT to use

·SNMPv1 or v2c on anything reachable from an untrusted network - the community string is cleartext on the wire
·SNMP write access. There is almost never a good reason to let an NMS modify device configuration over SNMP, and it is a well-worn attack path
·As the only telemetry on a modern platform. For sub-minute resolution, streaming telemetry (gRPC/gNMI) is better suited than polling - SNMP polls every 5 minutes typically, and a microburst lasts milliseconds
·Logging everything at `any any` to a remote host. The volume is large, most of it is noise, and it costs real money in a licensed SIEM
·Relying on local log files alone. They are lost when the device is replaced, and an attacker with access can clear them

How it compares

vs Cisco IOS SNMP/SyslogIOS configures SNMPv3 with three commands (`snmp-server group`, `snmp-server user`, `snmp-server host`); JunOS uses the more verbose but more explicit USM/VACM hierarchy, where the user, the group mapping and the access rules are separate statements. JunOS also has `structured-data`, which emits RFC 5424 syslog that a modern collector can parse into fields without regex.

vs Arista EOS SNMP/SyslogEOS binds management traffic with `snmp-server vrf MANAGEMENT` and `logging vrf MANAGEMENT`. JunOS uses routing instances instead, referenced with `routing-instance-access` for SNMP. The concepts match; the syntax does not.

vs Cisco NX-OS SNMP/SyslogNX-OS uses `use-vrf management` on both SNMP and logging commands. Both platforms require you to think about which routing table management traffic uses - getting this wrong is the single most common reason a newly configured device never appears in the NMS.

vs Streaming telemetry (gNMI/gRPC)SNMP is pull-based and typically polled every 5 minutes, so anything shorter than that is invisible. Streaming telemetry pushes at sub-second intervals and carries structured data. They coexist: SNMP for inventory and long-term trending, telemetry for operational visibility.

Prerequisites

→Management reachability already working - if the device cannot reach the NMS, nothing here will help
→NTP configured and synchronised. SNMPv3 authentication is time-sensitive, and log timestamps are useless for correlation without it
→The NMS poller addresses known in advance, for the client list
→SNMPv3 credentials generated and stored in a secrets manager, not in the repository
→The management routing instance name, if the device uses one

Config Generator

Hostname *

SNMP Location

Shown in the NMS inventory - be specific enough to find the device physically

SNMP Contact

SNMPv3 Username *

SNMPv3 Auth Password *

SHA authentication. Minimum 8 characters. Never commit the real value

SNMPv3 Privacy Password *

AES-128 encryption of the payload. Use a different value from the auth password

SNMP Pollers *

Only these sources may poll. Everything else is rejected

SNMP Trap Receivers

Every address here gets both halves of a v3 trap destination: its own `target-address` block under `snmp v3`, and an entry in the `trap-group` that selects which categories are sent. Leave empty to configure polling only

Syslog Servers *

Syslog Facility Override

NTP Servers *

Without correct time, every log timestamp is useless for correlation

NTP Boot Server

Queried once at boot to set time immediately. Usually your primary NTP server

Timezone

UTC is strongly recommended - local time across sites makes correlation painful

Management Routing Instance

Leave blank if management traffic uses the default instance

Syslog Source Address

Usually a loopback. Collectors often key on source address, so a varying one breaks dashboards

Verification commands

show snmp v3

Show the configured USM users, groups and access rules

ExpectedThe user appears with authentication sha and privacy aes128, mapped to a group that has a read view. A user with no group mapping can authenticate but will read nothing.

show snmp statistics

Show SNMP packet counters

ExpectedInput packets rising as the NMS polls. Zero input means the poll is not arriving - check reachability and the client list. Rising 'unknown user names' or 'unsupported security levels' means the NMS is configured with mismatched credentials.

show system ntp status

Confirm time is synchronised before trusting any timestamp

ExpectedA server marked with an asterisk and a small offset. Unsynchronised time undermines both log correlation and SNMPv3 authentication.

show log messages | last 20

Confirm local logging is working at all

ExpectedRecent events with full timestamps including the year. If the year is missing, `time-format year` has not been applied.

Debug commands

monitor start messages

Watch syslog live while reproducing an event

WarningOn a busy device this scrolls quickly. Stop it with `monitor stop` - leaving it running consumes RE cycles.

show snmp mib walk system

Walk the system MIB locally to confirm SNMP responds at all

WarningThis runs as the local user and bypasses the client list, so it proves the agent works but says nothing about whether a remote poller is permitted. Test from the NMS as well.

set system syslog host 10.0.0.60 any any

Temporarily raise remote logging to everything while chasing an issue

Warning`any any` is extremely verbose and will flood both the link and the collector. Set it, reproduce, then roll back immediately - and never commit it as a permanent configuration.

Common mistakes & fixes

SymptomThe NMS cannot poll the device, but the device is reachable by ping

CauseThe poller address is not in the client list, or SNMP traffic uses a routing instance that has not been granted access

FixCheck `show configuration snmp client-list`. If management is in a routing instance, `routing-instance-access` must list it. Test from the NMS: `snmpwalk -v3 -l authPriv -u <user> -a SHA -A <auth> -x AES -X <priv> <device> system`.

SymptomSNMPv3 authentication fails with 'unknown user name'

CauseThe username matches but the group mapping under vacm is missing, or the NMS is using a different security level

FixVerify with `show snmp v3`. The security level must match on both sides: configuring the device for `privacy` while the NMS requests `authNoPriv` fails even with correct credentials.

SymptomLog timestamps are an hour off, or inconsistent between devices

CauseTimezone set to local time on some devices and UTC on others, or NTP not synchronised

FixSet `time-zone UTC` everywhere. Correlating an incident across devices in three timezones is an avoidable problem. Confirm sync with `show system ntp status`.

SymptomRemote syslog receives nothing while local files have entries

CauseNo route to the collector from the correct routing instance, or the source address does not match what the collector expects

FixVerify reachability from the right table: `ping 10.0.0.60 routing-instance mgmt_junos`. Many collectors filter by source address - set `source-address` under the syslog host to a stable loopback rather than letting it vary by egress interface.

SymptomThe collector receives messages but cannot parse the fields

CauseThe device is sending legacy BSD-format syslog rather than structured data

FixAdd `structured-data` under the syslog host. That emits RFC 5424, which a modern collector parses into fields directly instead of requiring per-vendor regex.

Further learning

Recommended books to go deeper on this topic.

CCNP Enterprise Core ENCOR 350-401 Official Cert Guide

Brad Edgeworth et al. · Cisco Press · Network management: SNMP v1/v2c/v3, syslog levels, NTP, NetFlow

Kindle ↗Hardcover ↗