SNMP Configuration in MikroTik for Network Monitoring

Enabling SNMP for Network Monitoring

SNMP (Simple Network Management Protocol) allows external monitoring tools to query your MikroTik router for performance data, interface statistics, CPU usage, memory, and much more. Tools like LibreNMS, Zabbix, PRTG, and Grafana+Prometheus can use SNMP to build dashboards and send alerts.

What is SNMP?

SNMP is a protocol designed to let network management software poll devices for information. A device running SNMP is called an agent. The monitoring server is called the manager. The manager sends requests to the agent, and the agent responds with data.

Data in SNMP is organized in a tree structure called the MIB (Management Information Base). Each piece of data has a unique identifier called an OID (Object Identifier), like 1.3.6.1.2.1.1.1.0 (which is sysDescr — the system description).

RouterOS v7 supports:

• SNMPv1: Legacy, no security. Avoid if possible.
• SNMPv2c: Most common. Uses community strings for basic authentication.
• SNMPv3: Adds encryption and strong authentication. Recommended for security.

Enabling SNMP

/snmp set enabled=yes

Configuring Community Strings (SNMPv2c)

A community string acts like a password. By default, the community is public — change this immediately.

/snmp community add name=monitoring-ro security=none read-access=yes write-access=no addresses=192.168.1.100

Parameters:

• name: The community string name (this IS the password for SNMPv2c).
• read-access=yes: Allow reading data.
• write-access=no: Never allow write access unless you specifically need it.
• addresses: Restrict which IP can query this community (highly recommended).

Remove or disable the default public community:

/snmp community remove [find name=public]

Basic SNMP Settings

/snmp set contact="Network Admin <admin@example.com>" location="Server Room A" engine-id=auto trap-version=2 trap-community=monitoring-ro

• contact: Who to contact about this device.
• location: Physical location of the router.
• engine-id: Unique ID for this SNMP agent (auto-generate is fine).
• trap-version: Version for SNMP traps (notifications sent from router to manager).

Verifying SNMP is Working

From your monitoring server, test with snmpwalk (Linux):

snmpwalk -v2c -c monitoring-ro 192.168.1.1 1.3.6.1.2.1.1

This queries the system group OIDs and should return basic router information.

Test a specific OID — system uptime:

snmpget -v2c -c monitoring-ro 192.168.1.1 1.3.6.1.2.1.1.3.0

Useful MikroTik OIDs

MikroTik-specific OIDs start with 1.3.6.1.4.1.14988 (MikroTik enterprise OID).

Configuring SNMPv3 (Recommended)

SNMPv3 adds user-based authentication and optional encryption:

/snmp community add name=snmpv3-user security=SHA authentication-password=AuthPass123 encryption-password=EncPass123 encryption-protocol=AES read-access=yes addresses=192.168.1.100

From the monitoring server:

snmpwalk -v3 -u snmpv3-user -l authPriv -a SHA -A AuthPass123 -x AES -X EncPass123 192.168.1.1 1.3.6.1.2.1.1

Integrating with LibreNMS

1. Install LibreNMS on your monitoring server.
2. In LibreNMS, go to Devices > Add Device.
3. Enter the router IP, select SNMPv2c (or v3), enter your community string.
4. LibreNMS will auto-discover interfaces, CPU, memory, and more.
5. Set up alerts for interface down, high CPU, memory issues.

Integrating with Zabbix

1. In Zabbix, create a host with your router IP.
2. Link the Template Net MikroTik template (available in Zabbix template library).
3. Set the SNMP community macro {$SNMP_COMMUNITY} to your community string.
4. Zabbix will automatically discover and monitor interfaces, CPU, memory, uptime.

Protecting SNMP

SNMP v2c has no encryption — community strings are sent in plain text. Protect yourself:

/ip firewall filter add chain=input protocol=udp dst-port=161 src-address=192.168.1.100 action=accept comment="Allow SNMP from monitor"
/ip firewall filter add chain=input protocol=udp dst-port=161 action=drop comment="Block all other SNMP"

Only allow your monitoring server to reach SNMP (UDP port 161).

Summary

• Enable SNMP with /snmp set enabled=yes.
• Change the default community string from public to something custom.
• Restrict SNMP access to your monitoring server IP.
• Use SNMPv3 when possible for security.
• Integrate with LibreNMS, Zabbix, or similar for dashboards and alerts.
• Block SNMP on the firewall from any unauthorized source.