Juniper EX4300 / MAC limiting SNMP trap

Question

I have the following device and configuration:

Model: ex4300-32f

Junos: 17.3R3-S3.3

show configuration groups

GLOBAL-SNMP {
snmp {
client-list MANAGERS {
10.8.9.0/28;
}
community TEST-COMMUNITY {
authorization read-only;
client-list-name MANAGERS;
}
trap-options {
source-address 10.8.7.2;
context-oid;
}
trap-group TEST-COMMUNITY {
version v2;

targets {
10.8.9.2;
}
}
}
}

show configuration apply-groups

## Last changed: 2019-02-28 09:36:59 UTC
apply-groups GLOBAL-SNMP;

# show switch-options

interface ge-0/0/31.0 {
interface-mac-limit {
24;
packet-action shutdown;
}
}
interface-shutdown-action hard-shutdown;

When MAC limit exceeded, the switch does send linkDown SNMP trap and I succesfully receive it. I expect from the switch to send the jnxSecAccessIfMacLimitExceeded (.1.3.6.1.4.1.2636.3.40.1.2.1.0.2) SNMP trap as well. But I got only syslog messages:

L2ALD_MAC_LIMIT_REACHED_IF: Limit on learned MAC addresses reached for ge-0/0/31.0; current count is 24 
L2ALD_MAC_LIMIT_EXCEEDED_BLOCK: Limit on learned MAC addresses exceeded for ge-0/0/31.0; current count is 24 SHUTTING THE INTERFACE

I can use the raise-trap, but I think I have missed something and the switch can do it more "natively".

How should I configure EX4300 to send the SNMP trap regarding MAC limit exceed ?

Answer 1

After going over the existing documentation it appears that it is supported but not implemented, allow me to expand.

The TRAP jnxSecAccessIfMacLimitExceeded falls under Port Security Features, hence the mac-limit would be under the secure-access-port stanza, and as per documentation, these actions differ from the interface-mac-limit packet-action; they don't generate an SNMP trap:

https://www.juniper.net/documentation/en_US/junos/topics/reference/configuration-statement/mac-limit-port-security.html

https://www.juniper.net/documentation/en_US/junos/topics/reference/configuration-statement/packet-action-edit-bridge-domains-edit-protocols-l2-learning-edit-switch-options.html

Why supported? My approach would be first to check if there is support for the specific trap you are intending to use, as this might not always be true. For this you can use Junipers MIB Explorer.

From the MIB Explorer by looking up that TRAP on the Junos version you have we see the following hierarchy: https://apps.juniper.net/mib-explorer/search.jsp#object=jnxSecAccessIfMacLimitExceeded&product=Junos%20OS&release=17.3R3

iso > org > dod > internet > private > enterprises > juniperMIB > jnxMibs > jnxExMibRoot > jnxExSwitching > jnxExSecureAccessPort >

    jnxExSecureAccessPortMIB <<<
    
        jnxSecAccessPortMIBNotifications
            jnxSecAccessdsRateLimitCrossed
            jnxSecAccessIfMacLimitExceeded <<<
            jnxStormEventNotification

The takeaways here are that this is an Enterprise level MIB(as standard MIBs also exist), the jnxExSecureAccessPortMIB and your intended TRAP, which in this case is supported.

Although there is an Juniper Enterprise MIB, heading to the MIB explorer is perhaps more straightforward. https://www.juniper.net/documentation/en_US/junos/topics/concept/enterprise-specific-traps-overview.html

Next step would be to check for that MIB being registered with the snmpd, currently we lack of that information from your end.

On Monitoring SNMP Activity and Tracking Problems That Affect SNMP Performance on a Device Running Junos OS > Checking for MIB Objects Registered with the snmpd https://www.juniper.net/documentation/en_US/junos/topics/task/configuration/snmp-best-practices-monitoring-options.html

For the SNMP process to be able to access data related to a MIB object, the MIB object must be registered with the snmpd.

You can use the following commands to check for MIB objects that are registered with the snmpd:

`show snmp registered-objects`—Creates a /var/log/snmp_reg_objs file that contains the list of registered objects and their mapping to various subagents.

`file show /var/log/snmp_reg_objs`—Displays the contents of the /var/log/snmp_reg_objs file.

The same information is contained in KB17695: https://kb.juniper.net/InfoCenter/index?page=content&id=KB17695

To test TRAPS you can follow steps below:

From request snmp spoof-trap https://www.juniper.net/documentation/en_US/junos/topics/reference/command-summary/request-snmp-spoof-traps-command.html

You can test the trap:

user@host> request snmp spoof-trap jnxSecAccessIfMacLimitExceeded

OR

You can also check for available traps:

user@host> request snmp spoof-trap ?

Regarding the lack of snmp information on your log/messages, see information below:

From the Monitoring SNMP Activity and Tracking Problems That Affect SNMP Performance on a Device Running Junos OS https://www.juniper.net/documentation/en_US/junos/topics/task/configuration/snmp-best-practices-monitoring-options.html

On: Tracking SNMP Activity By default, Junos OS does not trace any SNMP activity. To enable tracking of SNMP activities on a device running Junos OS, include the traceoptions statement at the [edit snmp] hierarchy level.

A sample traceoptions configuration might look like below. Flagging all could be process intensive so keep an eye on cpu stats:

[edit snmp]
set traceoptions flag all;

You can always reach Juniper Forums, which I see you have done already (based on username from both sites): https://forums.juniper.net/t5/Ethernet-Switching/EX4300-MAC-limiting-SNMP-trap/td-p/459540

Recomendations given on the Forum:

• You can configure "set snmp traceoptions flag pdu" and check /var/log/snmpd to see if jnxSecAccessIfMacLimitExceed traps are getting generated.
• Check with the latest JTAC recommended release if you have the liberty to: https://kb.juniper.net/InfoCenter/index?page=content&id=kb21476
• remove the category hierarchy altogether and try the trace
• Engage JTAC