SNMP Configuration

Device Monitor can tell you whether a device is reachable without any configuration at all. To get CPU, memory, temperature, interface status, and throughput out of it, the device needs an SNMP agent and the platform needs credentials for it.

Credentials are stored encrypted and are never exposed to the browser.

Requirement	Detail
Protocol	UDP
Port	161 on the device
Direction	Platform to device, outbound only
Versions	SNMPv2c (community string) and SNMPv3 (user-based, with auth and privacy)

Allow UDP 161 from the platform's address range to your device management VLAN.

Step 1: Enable the agent on the device

The specifics vary by vendor, but the shape is always the same: turn the agent on, set a credential, and restrict which source addresses may query it.

Cisco IOS:

configure terminal
snmp-server community <read-only-community> ro
snmp-server location "Building A, Rack 3"
snmp-server contact "ops@example.com"
exit
write memory

On Cisco, two extra lines make interface data far more useful over time, because they stop interface indexes from renumbering across reboots:

snmp-server enable traps
snmp-server ifindex persist

FortiGate:

config system snmp sysinfo
  set status enable
  set location "Building A"
end
config system snmp community
  edit 1
    set name "<read-only-community>"
    set status enable
    config hosts
      edit 1
        set ip <platform-cidr>
      next
    end
  next
end

Linux hosts and industrial PCs:

sudo apt install snmpd snmp -y

Then in /etc/snmp/snmpd.conf:

rocommunity <read-only-community> <platform-cidr>
syslocation "Building A, Rack 5"
syscontact "ops@example.com"

sudo systemctl enable --now snmpd

Appliances with a web UI (Palo Alto, pfSense, UPS and PDU controllers) all follow the same path: find SNMP under device or network settings, enable the agent, set the v2c community or v3 credentials, and apply.

PLCs depend on the runtime. CODESYS-based controllers need the SysSNMP library added to the project before SNMP settings appear in the device configuration. Beckhoff exposes an SNMP server under System in TwinCAT System Manager.

Industrial cameras (Basler, FLIR, Cognex) implement SNMP inconsistently. Check the vendor documentation for which OIDs are actually populated before relying on them.

Step 2: Add the credentials

In the console, open the device from your site hierarchy, go to its SNMP configuration, choose the version, enter the credentials, and use Test Connection before saving. A test that fails here is a firewall or agent problem, not a credential problem, roughly nine times out of ten.

What gets polled

Standard MIB-II OIDs are discovered and polled automatically on a 60-second interval:

OID	What it gives you
sysDescr.0	System description
sysUpTime.0	Uptime
sysName.0	Hostname
hrProcessorLoad	CPU utilization
hrStorageUsed / hrStorageSize	Memory and disk usage
ifOperStatus	Interface up/down
ifInOctets / ifOutOctets	Interface throughput
entPhysicalTable	Hardware inventory
lmTempSensorsValue	Temperature sensors

Vendor-specific OIDs can be added per device when the standard set doesn't cover what you need.

Security

For v2c, never leave the community string at public, and restrict source addresses on the device itself rather than relying on the network to do it. v2c sends the community string in clear text, so treat it as an access control, not a secret.

For v3, use authPriv so traffic is both authenticated and encrypted, prefer SHA-256 and AES-256 where the device supports them, and rotate credentials on a schedule.

Either way, keep SNMP on a management VLAN with ACLs restricting who can reach port 161.

Troubleshooting

Symptom	Likely cause	What to do
SNMP unreachable	UDP 161 blocked	Check firewall rules along the path
Authentication failure	Wrong community or v3 credentials	Re-enter them; confirm the version matches the agent
No data after saving	Agent not actually running	Verify the SNMP service on the device
Stale data	Poll interval or intermittent connectivity	Check the network path and round-trip time
Timeouts	Latency or a loaded device	Increase the timeout; check device CPU

Next steps

• Device Monitor: where the polled data appears
• Connectivity: getting devices onto the network first
• Alerts & Notifications: alerting on what SNMP reports