Lab 01: Network Management - squatchulator/Tech-Journal GitHub Wiki

Lab 01: Network Management

I noticed this when I was working with the firewall rules in Powershell and hadn't heard of this before and couldn't really tell where it fit into firewalling. It seems like groups are set as collections of rules, sort of like zones and how those work in VyOS. https://learn.microsoft.com/en-us/powershell/module/netsecurity/get-netfirewallrule?view=windowsserver2022-ps

I'd heard of SNMP before and understood the concept behind it but in this lab I was confused as to why SNMP needed to be installed as like 4 separate things and why it's a service in the first place, as I thought it worked primarily as a protocol. Apparently this is possible with SNMPv1, which is a much more simple version that operates closer to the hardware layer, but SNMPv3 offers lots more security features and is a little easier to work with. https://www.digitalocean.com/community/tutorials/an-introduction-to-snmp-simple-network-management-protocol

In the context of VMs I've heard of provisioning before such as thin/thick provisioning, but I had no idea what that meant other than "thin provision all of your VMs because I told you to". Seems like thick provisioning actually reserves the specified disk space you give to your VM and disallows other resources from potentially using it, whereas thin provisioning only uses what the VM is actually using and takes up additional space as needed. https://www.nakivo.com/blog/thick-and-thin-provisioning-difference/

First off, go into Wks01 and navigate to the firewall's webpage (10.0.5.2) and log in. At the top click the services dropdown, and click SNMP. Check the Enable box, enter a location and your name as the location and contact, and set the community string to SYS265. At the bottom, bind the interface to LAN and save. Once saved, hit the reload button (restart) on the right at the top to restart the service.

Put it on the LAN, boot it up, create a new sudo user, and change the hostname.
In nmtui, the address is 10.0.5.11/24 and the gateway is 10.0.5.2 with the DNS as 10.0.5.10. Set the search domain to firstname.local. Go into Mgmt01 and add a A + PTR record to the DNS lookup records.
Now, assuming connectivity works, run sudo yum install net-snmp-utils to install. Check that DNS lookups work with nslookup 10.0.5.2, and then run a snmpwalk -Os -c SYS265 -v2c fw01-firstname system to get SNMP values

Throw it on the LAN before booting. Set it up with the address 10.0.5.200/24 and change the hostname + renamed sudo user.
Log in and run sudo yum install net-snmp-utils net-snmp
Make a backup with the current conf with sudo cp /etc/snmp/snmpd.conf /etc/snmp/snmpd.old, delete the .conf file, and create a new blank one with the same name. Edit it and add the following:

com2sec myNetwork 10.0.5.0/24 SYS265
group myROGroup v2c myNetwork
view all included .1 80
access myROGroup "" any noauth exact all none none

Run systemctl start snmpd and systemctl enable snmpd
Allow port 161/udp with sudo firewall-cmd --permanent --add-port=161/udp and reload
Now you should be able to see SNMP info if you run snmpwalk -Os -c SYS265 -v2c web01-firstname system on nmon01.

Now we need to install SNMP on Ad01. Go to Mgmt01 and Server Manager, then click Manage -> Roles and Features -> Next -> Next -> ad01 -> SNMP Service -> Install

Pretty much the same process but this time we need SNMP Tools instead. Go to Manage -> Roles and Features -> Next -> Next -> mgmt01 -> Remote Server Administration Tools -> Feature Administration Tools -> SNMP Tools -> Install

We can't remotely manage Ad01 from Mgmt01 in Server Manager due to some firewall restrictions. We will need to invoke a remote powershell session from Ad01 by right-clicking and selecting powershell. Use this command: Set-NetFirewallRule -DisplayGroup "Remote Event Log Management" -Enabled True. Remote Management should work now!
Under Services and Applications, go to Services -> SNMP Service -> Security and add the SYS265 community with Read Only rights. Also make sure nmon01-firstname is the only server in the Accept SNMP packets from box. Click Apply and OK, and restart the SNMP Service. SNMP queries to Ad01 should now work!