The following configuration steps need to be taken to allow SNMP communication from the server(s) hosting the Highlight pollers. Other IP sources will be blocked from using the SNMP community string configured.

• Log onto the router using the management web interface.
• Navigate to the Admin menu that allows you to modify the SNMP settings and the IP addresses that are allowed to poll your router.
• Depending on your router model, select the appropriate system security menu option and enable SNMP Management.
• Set your Get Community (Read only) and Set Community (Read-Write) to a string of your choice. The defaults of "public" and "private" must be changed.
• Add in the IP addresses of the Highlight pollers as allowed SNMP sources. This is sometimes called the Manager Host IP(IPv4).
• Some router models require you to enable remote management via the internet so you may need to enable the SNMP Server option in the Internet Access Control section if your router has this option.
• Apply and save the configuration. The device may need to be rebooted, depending on the model.

Always check to ensure you can still remotely manage the device; then continue to the next stage in adding the device as a watch in Highlight.

The following lines of configuration allow read-only SNMP communication from the server(s) hosting the Highlight polling of the device. Other IP sources will be blocked from using the SNMP community string configured.

SNMP v1/v2c

where highlightREAD   is the configured community string on the device, and 90   is any available access-list number or name.

SNMP v3

where 90 is any available access-list number or name, and the keys are at least 8 characters in length.

In order to utilise the performance visibility elements of Highlight the device needs to allow write access to the RTTMon MIB - a very small subset of the MIB tree only responsible for building IP SLA tests on the router. The 'view' line limits the WRITE access to the RTTMon MIB and the separate community string (still supported by access-list restrictions) adds another layer of authentication to the WRITE process:

SNMP v1/v2c

where highlightWRITE is the Read-Write SNMP password which must not be the same as the password used for Read-Only access; rttview is a view name used to restrict the SNMP read-write access; and 90 is the access-list number or name as used for Basic SNMP access.

SNMP v3

where rttview is a view name used to restrict the SNMP read-write access; and 90 is the access-list number or name as used for Basic SNMP access.

Additional configuration

The Precision Delay and MOS tests require a Cisco device as a target with the following configuration, and similarly a UDP Echo test between routers also requires this configuration on the target:

There are two ways to enable application visibility in Highlight. The first is via the NBAR application in Cisco routers, and details can be found on the NBAR configuration page.

Alternatively application visibility could be enabled using Flow, and details can be found on the Flow configuration page.

Both NBAR and Flow are needed to enable AppVis™.

Highlight is capable of showing traffic levels and health of individual classes of service.

The Basic SNMP Access defined above will show traffic for any outbound classes.

Because ISPs normally only set outbound QoS, to see a full 2-direction view of traffic it is necessary to add an inbound policy which, although not setting any prioritisation or queueing, does create SNMP counters for each class. The configuration is fully dependent on the configuration of the outbound QoS policy - read Class of Service for further details.

Whether using SNMP v2c or v3, restrict SNMP access with an access control list as follows:

where 2090  is any available access-list number or name

SNMP v2c

Additional code to set up SNMP access:

where highlightREAD   is the configured community string on the device, and 2090   is the configured access list.

SNMP v3

Additional code to set up SNMP access:

where 2090   is the configured access list.

SNMP v2c

SNMP v3

The basic v3 config for a Juniper SRX are below. Commands may differ per version and other platforms. Replace values in brackets with your own credentials.

The following example configuration for a OneAccess device allows for SNMP v2c read only access restricted to two specific poller IP addresses: