SNMP Configuration

The Simple Network Management Protocol (SNMP) is an Internet standard protocol that provides a method for managing network devices such as servers, workstations, routers, hubs, and bridges from a centrally located host running network management software. The Barracuda Web Application Firewall supports the following SNMP versions: SNMP v2c and SNMP v3.

A standard SNMP implementation includes three key components:

• SNMP Manager – software that runs on a management system and makes SNMP queries to a device. This managing system is called a Network Management System (NMS).
• SNMP Agent – software that runs on the managed device that maintains data for the device and responds to the SNMP queries/requests.
• Management Information Base (MIB) – a virtual repository for network management information that consists of a set of managed objects. These objects are organized in a hierarchical tree structure. Each object within the MIB tree has a unique object ID (OID), written as a series of integers.

The SNMP agent contains MIB variables, and the values of these variables can be requested by the SNMP manager through Get operations.

SNMP Configuration on the Barracuda Web Application Firewall

Before the Barracuda Web Application Firewall can be managed remotely by the system running SNMP Manager, perform the following tasks:

• Configure the SNMP agent
• Download the MIB files to your remote manager system. See the section "Downloading SNMP MIB Files" below.

Once the above tasks are performed, you can execute the SNMP commands on the network management system to manage the Barracuda Web Application Firewall.

Configuring the SNMP Agent

To configure the SNMP agent on the Barracuda Web Application Firewall, perform the following tasks:

• Configure Client Access to the SNMP Agent
  Configure the Barracuda Web Application Firewall to allow access to the SNMP agent from an SNMP manager system.

• Configure SNMP Traps
  Specify the destination SNMP manager system for SNMP traps.

Configuring Client Access (SNMP Manager)

The system running the SNMP manager software for remotely monitoring the Barracuda Web Application Firewall is referred as an SNMP client. The Barracuda Web Application Firewall supports SNMP version v2c and v3. Version v2c and v3 allow SNMP access only from the IP address(es) configured in the Allowed SNMP IP/Range field, and version v3 restricts SNMP access to only password-authenticated users.

Allow Client Access to the SNMP Agent

1. Go to the BASIC > Administration page.
2. In the SNMP Manager section, specify values for the following:
   • Enable SNMP Agent – Set to Yes to allow the Barracuda Web Application Firewall to accept and respond to the SNMP queries.
   • SNMP Version – Select the SNMP version (v2c or v3) to be used.
     • v2c - Allows SNMP access only to the IP address(es) configured in the Allowed SNMP IP/Range field.
       • SNMP Community String – Specify the community string, or password for authenticating SNMP access.
         As a best practice, use a unique account for this integration point and grant it the least level of privileges required, coordinating with the SNMP administrator. For additional information, see Security for Integrating with Other Systems - Best Practices .
     • v3 – Encrypts the SNMP traffic and limits access to only password-authenticated users.
       • User – Enter a name to be used for authenticating SNMP v3 queries.

       • Password – Enter the password to be used for the specified user.
         As a best practice, use a unique account for this integration point and grant it the least level of privileges required, coordinating with the SNMP administrator.  For additional information, see Security for Integrating with Other Systems - Best Practices .

       • Authentication Method – Select the authentication method (MD5 or SHA) supported by your SNMP monitor. Note: SHA is the more secure method.
       • Encryption Method – Select the encryption method (DES or AES) supported by your SNMP monitor. Note: AES is the more secure method.
   • Allowed SNMP IP/Range – Specify the IP address(es) for which SNMP access needs to be allowed to connect to the Barracuda Web Application Firewall.
3. Click Save Changes.

Configuring SNMP Traps

Traps are unsolicited notification messages generated by the Barracuda Web Application Firewall and sent to the SNMP manager when significant events occur on the Barracuda Web Application Firewall. These notification messages are sent only to the IP address(es) configured in the Trap Receivers section on the BASIC > Administration page.

The Barracuda Web Application Firewall can generate SNMP alerts for the following events:

Downloading SNMP MIB Files

A MIB file contains a set of definitions for each managed object. It defines the data type, accessibility, description, and the current validity of the object. The Barracuda Web Application Firewall provides two MIB files that can be downloaded and imported to your SNMP manager.

Download the MIB Files

1. Go to the BASIC > Administration page, and click Help.
2. Scroll down to the SNMP Manager section, click the link The Barracuda Web Application Firewall MIB, and save the Barracuda-BWS-MIBS.tar file. 

SNMP Table and Statistics

An SNMP table is an ordered collection of objects. Each row contains one or more objects, and each object in a table is identified using the table index. The Barracuda Web Application Firewall contains 50 object identifiers in the SNMP table.

The following table displays the statistics polled for the SNMP tables:

Using SNMP

Collecting Performance Data

The types of performance data that can be gathered using SNMP on the Barracuda Web Application Firewall are as follows:

• Memory use
• Number of active connections per service
• Number of HTTP requests per service
• Number of SSL transactions per service

Each performance data type is associated with one or more SNMP object IDs (OIDs). To gather performance data, specify the OIDs with the appropriate SNMP command.

For example, the following SNMP command collects data on current memory use, where “public” is the community name and 10.11.31.231 is the IP address of the Barracuda Web Application Firewall:

snmpget -c public –v 2c 10.11.31.231 .1.3.6.1.4.1.20632.8.19

For some types of metrics, you can just issue an SNMP command with an OID to get the needed information. Example: Memory use. Whereas, there are some types of metrics where the data collected with SNMP is not useful until a calculation is performed on it to interpret the data.

For example, to determine the throughput rate of client bits coming into the Barracuda Web Application Firewall, you must use the relevant OID:

( httpProxyInBytes  (1.3.6.1.4.1.20632.8.50.1.1.14)) to take two polls at a certain interval (such as ten seconds), calculate the delta of the two polls, and then perform the following calculation on that delta value:

( <DeltaStatClientBytesIn>*8 ) / <interval>

Collecting Data on Memory Use

This section provides information on how to gather data on the number of bytes of memory currently being used on the Barracuda Web Application Firewall.

The following OIDs are required for collecting metrics on memory use:

Collecting Data on System Status

This section provides information on how to gather data on the number of active connections on the Barracuda Web Application Firewall.

The following OIDs are required for collecting metrics on System Status:

Collecting Data on System Configuration

This section provides information on how to gather and interpret data on the number of applications  on the Barracuda Web Application Firewall. You can also gather info on the total servers and their status.

The following OIDs are required for polling data on new connections:

Collecting Data on HTTP Requests for a Service

This section provides information on how to gather and interpret data on the number of current HTTP requests on the Barracuda Web Application Firewall for a given service, in terms of requests per minute.

To gather and interpret the data for this metric, you must perform some polling and calculations:            

1. Use the OID and perform two separate polls, at an interval of your choice.          
2. Calculate the delta of the two poll values.           
3. Perform a calculation on the OID delta.

The table below shows the OID that you must poll, retrieving two separate poll values for this OID.

Required OIDs for polling data on HTTP requests:

For example, to collect data on HTTP requests for the HTTP Requests graph metric, follow these steps.

1. Poll OID httpProxyTotalReq (.1.3.6.1.4.1.3375.2.1.1.2.1.56) twice, at a 60-second interval.
   This results in two values: <sysStatHttpRequests1> and <sysStatHttpRequests2>. This OID will retrieve HTTP requests for all HTTP services.
   To retrieve HTTP requests for a specific service, append the IP address in the OID. Example: 1.4.99.99.102.10.80, where 1.4 is the IPv4 version, 99.99.102.10 is the service IP address, and 80 is the port number. 

   The minimum polling frequency for interval is 60 seconds.

2. Calculate the delta of the two poll values:
   <DeltaHttpProxyRequests> = <httpProxyTotalReq2> - <httpProxyTotalReq1>
3. Calculate the value of the HTTP Requests graph metric using the calculation shown in the table below, where the value of <interval> is 60.

Required calculations for interpreting metrics on HTTP requests:

Collecting Data on SSL Transactions

This section provides information on how to gather and interpret data on SSL performance, in terms of transactions per minute.

To gather and interpret the data for this metric, you must perform some polling and calculations:

1. Use the OID and perform two separate polls at an interval of your choice.
2. Calculate the delta of the two poll values.
3. Perform a calculation on the OID delta.

The table below shows the OID that you must poll, retrieving two separate poll values for this OID.

Required OIDs for polling for data on HTTP requests:

For example, to collect data on HTTP requests for the HTTP Requests graph metric, follow these steps.

1. Poll OID sslProxyTotalReq (.1.3.6.1.4.1.20632.8.50.2.1.18) twice, at a 60-second interval.
   This results in two values: <sysStatHttpRequests1> and <sysStatHttpRequests2>. This OID will retrieve HTTP requests for all HTTP Services. To retrieve HTTP requests for a specific service, append the IP address in the OID. Example: 1.4.99.99.102.24.443, where 1.4 is the IPv4 version, 99.99.102.24 is the Service IP address and 443 is the port number.

   The minimum polling frequency for interval is 60 seconds.

2. Calculate the delta of the two poll values:
   <DeltasslProxyTotalReq > = < sslProxyTotalReq2> - < sslProxyTotalReq1>
3. Calculate the value of the HTTP Requests graph metric using the calculation shown in the table below, where the value of <interval> is 60.

Required calculations for interpreting metrics on HTTP requests

Practical Use of SNMP

For demonstration purposes, an NMS Server (PRTG) trial version was deployed to import the MIB files of the Barracuda Web Application Firewall. SNMP settings were configured on the NMS server to generate information on the various sensors, some of which are shown below:

HTTP service-based statistics were collected for a period of 2 days:

Live data snapshot: