By the SNMP Monitoring team · Reviewed July 2026
Standing up SNMP is a five-step path that's easy to get working and easy to get wrong — the difference being whether you leave a public community open to the internet or lock it down properly. This hub walks the whole route: install the agent, configure snmpd.conf, secure access, open the firewall to exactly the right source, and prove it with a walk. Each step has a dedicated page that goes deep; this page is the map that ties them together so you don't skip the part that matters.
Parent: home. The deep config reference is snmpd.conf.
The setup checklist
The end-to-end path, in order:
- Install the agent — net-snmp
snmpdon Linux, or the SNMP feature on Windows. - Configure
snmpd.conf— listen address, access model, system info. - Secure access — SNMPv3, or v2c with a random community, an OID allowlist, and a source-IP ACL.
- Open the firewall — allow UDP 161 from your poller only, not the world.
- Test — run a
snmpwalkfrom the manager and confirm you get data.
Do them in this order. The most common mistake is opening the firewall before securing access, which briefly exposes a default community to anything that can reach the box.
Why the ordering matters so much is worth spelling out, because it's the difference between a clean setup and an incident. Each step assumes the previous one is done: there's no point configuring snmpd.conf before the package exists, no point opening a firewall port to an agent that's still bound to localhost, and definitely no point exposing an agent to the network before you've replaced the default public community and scoped what it can read. The failure mode people hit is doing step 4 (firewall) before step 3 (secure) — they install, see it "not working" from a remote poller, punch a hole in the firewall to fix reachability, and in doing so briefly publish a wide-open agent with a guessable community to everything that can route to it. Internet scanners find public on UDP 161 in minutes. So treat the order as a safety property, not a suggestion: secure the agent first, and only then make it reachable.
Installing the agent
On Linux the agent is net-snmp's snmpd, installed from your distro's packages and configured at /etc/snmp/snmpd.conf. On Windows, SNMP is an optional (and now legacy) feature — usable, but for modern setups you'd lean toward SNMPv3 or a third-party agent. Pick your platform's guide:
- Ubuntu / Debian —
apt install snmpd snmp - CentOS / RHEL —
dnf install net-snmp net-snmp-utils(Rocky, Alma too) - Windows Server — the SNMP Service feature
Whatever the OS, the shape is the same: install a package, edit a config file, restart a service, open a port, test.
Configuring snmpd
snmpd.conf is where every access and exposure decision lives — the listen address, who can read what, and the system identity. It's worth understanding rather than copy-pasting, because a single wrong directive is the difference between "reads on the mgmt interface only" and "world-readable." The full directive reference — agentAddress, rocommunity, createUser/rouser, VACM views, sysLocation, traps, extend — is on the dedicated page: snmpd.conf configuration guide. Start there once the package is installed.
Securing access
This is the step people skip, and it's the one that turns SNMP from a monitoring tool into a reconnaissance gift. Two models:
| Approach | Confidentiality | Use when |
|---|---|---|
| SNMPv3 (authPriv) | Authenticated + encrypted | Anything crossing untrusted networks — preferred |
| v2c + random community + allowlist + ACL | None (community is plaintext) | Trusted management segment only |
Prefer SNMPv3 — it authenticates and encrypts, so a sniffed packet doesn't hand over your community. If you must run v2c, do three things together: use a random community string (never public), restrict what's readable with an OID allowlist (VACM), and limit who can ask with a source-IP ACL. Any one alone is weak; the three together are defensible on a trusted segment.
Firewall & ports
SNMP polling is UDP 161; traps are UDP 162. The firewall rule should allow 161 from your poller's IP only, not from anywhere. An agent bound to a management interface and firewalled to a single source is a small attack surface; the same agent open to 0.0.0.0 with public is an incident waiting to happen. See firewall setup and the SNMP ports reference.
Testing
Once it's up and secured, prove it from the manager, not the GUI:
snmpwalk -v2c -c <RO_string> <host> system
SNMPv2-MIB::sysDescr.0 = STRING: Linux host1 5.15.0-generic x86_64
SNMPv2-MIB::sysObjectID.0 = OID: NET-SNMP-MIB::netSnmpAgentOIDs.10
SNMPv2-MIB::sysUpTime.0 = Timeticks: (884213700) 102 days, 8:22:17.00
SNMPv2-MIB::sysContact.0 = STRING: netops@example.com
Data back means the agent, the credentials, the firewall, and the route are all correct. An empty or timed-out result sends you to troubleshooting; flag reference is on snmpwalk. <RO_string> is a placeholder — never commit a live community.
Adding external monitoring
An on-site poller sees the host only when the site itself is up. For the failures that take the whole site down, add an independent off-box check. That's what external monitoring is for — a service like ostr.io polls the agent over agentless SNMPv2c from outside your infrastructure, so a dead site still pages you. Setup notes are on add an SNMP endpoint.
Frequently asked questions
How do I set up SNMP?
Install the agent (net-snmp snmpd on Linux, the SNMP feature on Windows), edit /etc/snmp/snmpd.conf to set the listen address and access model, secure it with SNMPv3 or a random v2c community plus an OID allowlist and source-IP ACL, open UDP 161 from your poller, then test with snmpwalk. Each step has a dedicated guide linked above.
Where is snmpd.conf?
On Linux, the net-snmp agent reads /etc/snmp/snmpd.conf. Some distros also have /etc/default/snmpd (Debian/Ubuntu) or a sysconfig file (RHEL family) that controls daemon options like the listen address. Edit snmpd.conf for access and exposure, then restart the service.
How do I test that SNMP is working?
Run snmpwalk -v2c -c <RO_string> <host> system from a manager that can reach the agent. Getting back sysDescr, sysUpTime and friends confirms the agent, credentials, firewall and route are all correct. A timeout usually means the firewall, listen address, or community is wrong.
Should I use v2c or v3 for setup?
Prefer SNMPv3 wherever the traffic crosses anything untrusted — it authenticates and encrypts, so a captured packet doesn't leak your credentials. v2c is acceptable only on a trusted management segment, and only with a random community, an OID allowlist, and a source-IP restriction all in place together.
Key takeaways
- Setup is five steps: install → configure → secure → firewall → test — in that order.
- Linux agent is net-snmp
snmpdat/etc/snmp/snmpd.conf; restart after edits. - Secure before you open the firewall — prefer SNMPv3, or v2c with random community + allowlist + source ACL.
- Polling is UDP 161, traps UDP 162 — allow from your poller only.
- Test with
snmpwalk … system; a timeout points at firewall/listen/community. - Add an off-box external check so a dead site still pages you.