Configure SNMP Discovery

Overview

SNMP is the primary source of device identity, interface state, PoE budget and topology hints for switches, firewalls, wireless controllers and access points. AssurIQ supports SNMPv1, v2c and v3; SNMPv3 is strongly recommended because it authenticates and encrypts every request.

Create a credential profile

SNMP credentials are stored once in the Credential Vault and reused across every device that matches the profile's scope.

1. 1
   Open Credential Vault

   Navigate to Credential Vault and select New Credential, type SNMP.
2. 2
   Choose SNMPv3

   Set the security level to authPriv, the auth protocol to SHA-256, and the privacy protocol to AES-128 or AES-256, matching what the device supports.
3. 3
   Set username and passphrases

   Enter the SNMPv3 username, authentication passphrase and privacy passphrase. AssurIQ encrypts these at rest and never displays them again in plain text.
4. 4
   Scope the profile

   Assign the profile to a site, a device group, or an IP range so discovery applies it automatically.

Vendor configuration

Enable SNMP on the device using credentials that match the profile created above. Examples for common vendors follow.

snmp-server group AIQ-GROUP v3 priv
snmp-server user aiq-svc AIQ-GROUP v3 auth sha AUTH_PASSPHRASE priv aes 128 PRIV_PASSPHRASE
snmp-server view AIQ-VIEW iso included
access-list 10 permit host 10.0.0.15
snmp-server community AIQ-RO RO 10

config system snmp sysinfo
    set status enable
end
config system snmp user
    edit "aiq-svc"
        set security-level auth-priv
        set auth-proto sha256
        set auth-pwd AUTH_PASSPHRASE
        set priv-proto aes128
        set priv-pwd PRIV_PASSPHRASE
        set notify-hosts 10.0.0.15
    next
end

UniFi (self-hosted controller or UniFi OS console): open Settings > System > SNMP, enable SNMP, and set the community string or SNMPv3 credentials to match the AssurIQ profile. Apply the change to the site.

Meraki dashboard: navigate to Organization > Settings > SNMP, enable SNMPv3, enter the auth and privacy passphrases, then confirm the management IP or Dashboard API polling location is allow-listed for the collector's egress.

snmp-server vrf default
snmp-server user aiq-svc group AIQ-GROUP auth sha256 auth-pass AUTH_PASSPHRASE priv aes128 priv-pass PRIV_PASSPHRASE
snmp-server group AIQ-GROUP user-version v3 security-level auth-priv

# Services > SNMP
Enable: checked
SNMP v3: enabled
Security username: aiq-svc
Authentication algorithm: SHA
Authentication password: AUTH_PASSPHRASE
Privacy algorithm: AES
Privacy password: PRIV_PASSPHRASE
Bind Port: 161, allow only the collector source IP under the firewall rule for the SNMP port

ACL guidance

• Restrict SNMP to the collector's IP address or a small management subnet, never to any-source.
• Keep UDP 161 closed on any interface facing the internet or an untrusted VLAN.
• If SNMP traps are used for anything, restrict trap destinations the same way.

Verification

After configuring both the credential profile and the device, trigger a discovery run for the site or wait for the next scheduled cycle.

1. Open the device in Asset Inventory or Network Map.
2. Confirm system name, model and firmware populated from SNMP.
3. Confirm interface list and PoE data (if applicable) are present.
4. If the device still shows no SNMP data after one cycle, see Troubleshoot SNMP.

Reference

• AIQ-SNMP-001SNMP timeout
  The device did not answer SNMP requests within the timeout.
• AIQ-SNMP-002SNMP authentication failed
  The credential profile was rejected by the device (bad community string or SNMPv3 auth/priv mismatch).

• Troubleshoot SNMP
  Timeouts, authentication failures and partial MIB support.
• Network Discovery
  ARP, ICMP, SNMP, LLDP/CDP and DHCP seeding; scopes and schedules.
• Credential Vault
  Storing SNMP, SSH, WinRM and API credentials safely.