DX NetOps

we recieve traps from ip address 0.0.0.0 instead of actual source ip address wnenever we ask SNMP traps from Vcenter, please help me out from this situation.

Spectrum is only processing the trap as it is received. This will need to be addressed on the Vcenter side. Recommend posting to the CA Virtual Assurance for Infrastructure Managers community.

do you have any idea to get out of this awkward situation. 

Hi Kuldeep,

Unfortunately there is nothing that can be done on the Spectrum side. As Joe mentioned, Spectrum can only process the traps as they are received. This issue would need to be fix on the sending side.

Best regards,

Bill

Hi,

I did not test it with VCenter or VMWare-Models but I did some testing with Event_Admins.

If CA cannot provide a solition, probably the Event-Admin/SouthboundGW could help out.

Basically: There are 2 places for a source-IP in a SNMPTrap. .. the IP in the IP-Header and one IP as a Host-Address in the Trap-PDU (Header)

Probably the IP in the Trap-PDU is 0.0.0.0 ??

... there is one Modeltype, which is able to collect trap via the IP-Header....  the Event-Admin-Model.

Create one of these Models and try to get the IP which is in the IP Header as the IP of the Event-Admin.

Then set the attribute of the Event-Admin to this IP-Address and the the attribute "map_traps_by_ip..." there is only one attribute which starts with "map...".

Set this to the proper IP and watch the Traps comming in.

Probably You have to derive the Eventsdisp -files and copy a alertmap-file as special registred events for a "SBGW"  Southboundgateway. Probably it is possible to collect the vCenter-Alerts with this Event-Admin or further more, probably You are able to reroute the Events and Alarms back to Your existing VCenter-Model.

I know, this is not an exact description and only hints.

Best Regards

Erich

thanks for your valuable input, I have already implemented this, that you are suggested, but didn't work for me.

apart from that in our environment we have four Vcenter's and we are getting traps from desired IP address.  

and if you have any suggestion apart from this please let me know to get out of this situation.

Hi,

are You able to create a PCAP – Wireshark-Capture for the Traps?

You need to get the IP-Address in the IP-Header first.

I believe, Wou will find IP-Addresses of Your vCenters in the IP-Header.

Then Create an Event-Admin for each of Your VCenters with its IP-Address.

Then set the attribute “map_traps_to_this_model_using_IP_header“ of the Event-Admin to to “yes” and from that moment, the trap should get assigned to this model with the IP in the IP-Header.

If You would like to remap the Event/Alarm to the vCenter-Model and not keep it at the Event_Admin, then You need to copy the Alertmap – Trap-mapping for each Trap-Type You would like to map into an extra folder /specroot/custom/Events/gen_app_gw/

Best Regards

Erich

Von: kuldeep.ku

Gesendet: Donnerstag, 16. Juni 2016 13:49

An: Heinemann, Erich <e.heinemann@telonic.de>

Betreff: Re:  - recieve traps from 0.0.0.0 instead of Actual IP address when we ask a trap from vCenter

CA Communities <https://communities.ca.com/?et=watches.email.thread>

recieve traps from 0.0.0.0 instead of Actual IP address when we ask a trap from vCenter

reply from kuldeep.ku<https://communities.ca.com/people/kuldeep.ku?et=watches.email.thread> in CA Infrastructure Management - View the full discussion<https://communities.ca.com/message/241892368?et=watches.email.thread#comment-241892368>

Hi,

I understand what you are trying to say, but I am not getting trap from proper source, and for your reference I have attached the screenshot of the same.

Thanks|Regards,

Kuldeep Kumar,

HCL Technologies - ISD.

DID US :  +12013669520 Exn: 4211529

DID SWEDEN : +46850516372 Extn: 4211529

Mobile: +91-8146631112

Email: Kuldeep_ku@hcl.com

Team DL : HusqInfraTools@hcl.com<mailto:HusqInfraTools@hcl.com>

Hi,

ok, in the screenshot I could see that the Source is 10.46.198.122

Yes, the IP in the Trap-PDU is 0.0.0.0

If 10.46.198.122 is a proper IP, than try to use this as the IP of the Event-Admin and change the setting of the attribute as described.

Probably You have to ask a local CA Partner or CA itself to help out.

Best Regards

Erich

Von: kuldeep.ku

Gesendet: Donnerstag, 16. Juni 2016 15:38

An: Heinemann, Erich <e.heinemann@telonic.de>

Betreff: Re:  - recieve traps from 0.0.0.0 instead of Actual IP address when we ask a trap from vCenter

CA Communities <https://communities.ca.com/?et=watches.email.thread>

recieve traps from 0.0.0.0 instead of Actual IP address when we ask a trap from vCenter

reply from kuldeep.ku<https://communities.ca.com/people/kuldeep.ku?et=watches.email.thread> in CA Infrastructure Management - View the full discussion<https://communities.ca.com/message/241892462?et=watches.email.thread#comment-241892462>

Hi,

I have already configured the EventAdmin with this IP address  10.46.198.122 and enable the required attributes, but traps are not mapped to the respective EventAdmin.

Thanks|Regards,

Kuldeep Kumar,

HCL Technologies - ISD.

DID US :  +12013669520 Exn: 4211529

DID SWEDEN : +46850516372 Extn: 4211529

Mobile: +91-8146631112

Email: Kuldeep_ku@hcl.com

Team DL : HusqInfraTools@hcl.com<mailto:HusqInfraTools@hcl.com>

Can you expand the 'varbinds' bit in your screenshot so we can see the actual varbinds please?

If you are getting traps and the oid which mentions the device it's reporting about (not the actual host sending the trap as it seems in this case) is not providing the correct IP then it will be very difficult. E.g. if you have Cisco Prime with IP of 1.1.1.1 sending a trap which is about 2.2.2.2 - if you don't see 2.2.2.2 in any of the varbinds I don't think it's possible (perhaps a text file containing hostname to IP's if you have the hostname in the varbinds - but not sure you can even do lookups!).

You are receiving an SNMPv1 trap which means the source sending the trap can make it look like it's coming from anywhere (0.0.0.0 in this case). If you send the trap using SNMPv2c that might resolve this issue.

Can you explain exactly what is sending these traps please? Is it a script getting info from VCentre or actual VMware VCentre component? If it is VMWare then the vendor should correct this issue so you can see which VCentre it's coming from.

Can you provide what version of VCentre you are using please? Perhaps it's time to see if there are any updates for it.

Hi,

unfortunately I can't verify at the moment, so this is all from my aging memory.

We had the same issue in the past. As Spectrum is using the trap PDU address (not ip layer source ip) to determine the destination model, 0.0.0.0 will lead to the VNM model "trash can".

Basically the vCenter application's trap logic was unable to determine the correct local ip address due to non-existent hostname-to-ip mapping. We were able to solve the issue by adding/changing some configuration on the vCenter server (appliance) OS level. After adding a matching entry to /etc/hosts, we got proper traps.

I don't like static entries in /etc/hosts, but this time VMware has to be blamed, not CA.

Hope this helps,

Raphael