Configure Zabbix SNMP monitoring for network devices with automated discovery and templates

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# Global variables
SNMP_COMMUNITY="${1:-monitoring}"
ZABBIX_SERVER_IP="${2:-}"
LOG_FILE="/tmp/zabbix_snmp_install.log"

# Usage function
usage() {
    echo "Usage: $0 [SNMP_COMMUNITY] [ZABBIX_SERVER_IP]"
    echo "  SNMP_COMMUNITY: SNMP community string (default: monitoring)"
    echo "  ZABBIX_SERVER_IP: IP address of this Zabbix server for ACLs"
    echo ""
    echo "Example: $0 monitoring 192.168.1.100"
    exit 1
}

# Logging function
log() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" >> "$LOG_FILE"
    echo -e "$1"
}

# Error handling
cleanup_on_error() {
    log "${RED}[ERROR] Installation failed. Check $LOG_FILE for details${NC}"
    exit 1
}

trap cleanup_on_error ERR

# Check if running as root or with sudo
check_privileges() {
    if [[ $EUID -ne 0 ]]; then
        log "${RED}[ERROR] This script must be run as root or with sudo${NC}"
        exit 1
    fi
}

# Detect distribution
detect_distro() {
    log "${BLUE}[1/8] Detecting operating system...${NC}"
    
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        case "$ID" in
            ubuntu|debian)
                PKG_MGR="apt"
                PKG_UPDATE="apt update"
                PKG_INSTALL="apt install -y"
                SNMP_CONFIG_DIR="/etc/snmp"
                SNMP_PACKAGES="snmp snmp-mibs-downloader"
                ;;
            almalinux|rocky|centos|rhel|ol|fedora)
                PKG_MGR="dnf"
                PKG_UPDATE="dnf update -y"
                PKG_INSTALL="dnf install -y"
                SNMP_CONFIG_DIR="/etc/snmp"
                SNMP_PACKAGES="net-snmp net-snmp-utils"
                ;;
            amzn)
                PKG_MGR="yum"
                PKG_UPDATE="yum update -y"
                PKG_INSTALL="yum install -y"
                SNMP_CONFIG_DIR="/etc/snmp"
                SNMP_PACKAGES="net-snmp net-snmp-utils"
                ;;
            *)
                log "${RED}[ERROR] Unsupported distribution: $ID${NC}"
                exit 1
                ;;
        esac
        log "${GREEN}Detected: $PRETTY_NAME${NC}"
    else
        log "${RED}[ERROR] Cannot detect operating system${NC}"
        exit 1
    fi
}

# Update package repositories
update_packages() {
    log "${BLUE}[2/8] Updating package repositories...${NC}"
    $PKG_UPDATE >> "$LOG_FILE" 2>&1
    log "${GREEN}Package repositories updated${NC}"
}

# Install SNMP packages
install_snmp_packages() {
    log "${BLUE}[3/8] Installing SNMP packages...${NC}"
    $PKG_INSTALL $SNMP_PACKAGES >> "$LOG_FILE" 2>&1
    
    # Install MIB packages for RHEL-based systems
    if [[ "$PKG_MGR" =~ ^(dnf|yum)$ ]]; then
        $PKG_INSTALL net-snmp-perl >> "$LOG_FILE" 2>&1 || true
    fi
    
    log "${GREEN}SNMP packages installed successfully${NC}"
}

# Configure SNMP client
configure_snmp_client() {
    log "${BLUE}[4/8] Configuring SNMP client settings...${NC}"
    
    # Create SNMP configuration directory if it doesn't exist
    mkdir -p "$SNMP_CONFIG_DIR"
    
    # Configure snmp.conf
    cat > "$SNMP_CONFIG_DIR/snmp.conf" << EOF
# SNMP client configuration for Zabbix monitoring
# Generated on $(date)

# Enable MIB loading (comment out 'mibs :' line)
# mibs :

# Default community string
defCommunity $SNMP_COMMUNITY

# Default SNMP version
defVersion 2c

# Timeout and retry settings
timeout 5
retries 3

# Don't load all MIBs by default on RHEL systems
$(if [[ "$PKG_MGR" =~ ^(dnf|yum)$ ]]; then echo "mibs +ALL"; fi)
EOF
    
    chmod 644 "$SNMP_CONFIG_DIR/snmp.conf"
    chown root:root "$SNMP_CONFIG_DIR/snmp.conf"
    
    # For Debian-based systems, enable MIBs
    if [[ "$PKG_MGR" == "apt" ]]; then
        if [ -f /etc/snmp/snmp.conf.dist ]; then
            sed -i 's/^mibs :/#mibs :/' /etc/snmp/snmp.conf.dist 2>/dev/null || true
        fi
    fi
    
    log "${GREEN}SNMP client configuration completed${NC}"
}

# Configure firewall rules
configure_firewall() {
    log "${BLUE}[5/8] Configuring firewall for SNMP...${NC}"
    
    if command -v ufw >/dev/null 2>&1 && ufw status | grep -q "Status: active"; then
        # Ubuntu/Debian with UFW
        ufw allow out 161/udp comment 'SNMP monitoring' >> "$LOG_FILE" 2>&1 || true
        log "${GREEN}UFW rules configured${NC}"
    elif command -v firewall-cmd >/dev/null 2>&1 && systemctl is-active firewalld >/dev/null 2>&1; then
        # RHEL-based with firewalld
        firewall-cmd --permanent --add-port=161/udp >> "$LOG_FILE" 2>&1 || true
        firewall-cmd --reload >> "$LOG_FILE" 2>&1 || true
        log "${GREEN}Firewalld rules configured${NC}"
    else
        log "${YELLOW}No active firewall detected or manual configuration required${NC}"
    fi
}

# Test SNMP connectivity
test_snmp_connectivity() {
    log "${BLUE}[6/8] Testing SNMP connectivity...${NC}"
    
    # Test with localhost if available
    if systemctl is-active snmpd >/dev/null 2>&1 || pgrep snmpd >/dev/null 2>&1; then
        if snmpwalk -v2c -c public localhost 1.3.6.1.2.1.1.1.0 >/dev/null 2>&1; then
            log "${GREEN}Local SNMP test successful${NC}"
        else
            log "${YELLOW}Local SNMP test failed - this is normal if no local SNMP agent is running${NC}"
        fi
    else
        log "${YELLOW}No local SNMP agent running - skipping local test${NC}"
    fi
    
    log "${GREEN}SNMP tools are ready for network device monitoring${NC}"
}

# Create monitoring scripts and examples
create_monitoring_examples() {
    log "${BLUE}[7/8] Creating monitoring examples and scripts...${NC}"
    
    # Create examples directory
    mkdir -p /opt/zabbix-snmp-examples
    
    # Create test script
    cat > /opt/zabbix-snmp-examples/test-snmp.sh << 'EOF'
#!/bin/bash
# SNMP connectivity test script
# Usage: ./test-snmp.sh <device_ip> [community]

DEVICE_IP="${1:-}"
COMMUNITY="${2:-monitoring}"

if [ -z "$DEVICE_IP" ]; then
    echo "Usage: $0 <device_ip> [community]"
    echo "Example: $0 192.168.1.1 public"
    exit 1
fi

echo "Testing SNMP connectivity to $DEVICE_IP..."
echo "Community: $COMMUNITY"
echo ""

# Test system description
echo "System Description:"
snmpwalk -v2c -c "$COMMUNITY" "$DEVICE_IP" 1.3.6.1.2.1.1.1.0 2>/dev/null || echo "Failed"
echo ""

# Test system name
echo "System Name:"
snmpget -v2c -c "$COMMUNITY" "$DEVICE_IP" 1.3.6.1.2.1.1.5.0 2>/dev/null || echo "Failed"
echo ""

# Test interface table
echo "Interface Count:"
snmpwalk -v2c -c "$COMMUNITY" "$DEVICE_IP" 1.3.6.1.2.1.2.1.0 2>/dev/null || echo "Failed"
EOF
    
    chmod 755 /opt/zabbix-snmp-examples/test-snmp.sh
    chown root:root /opt/zabbix-snmp-examples/test-snmp.sh
    
    # Create Cisco configuration example
    cat > /opt/zabbix-snmp-examples/cisco-config-example.txt << EOF
! Example Cisco SNMP configuration
! Replace IP addresses and community strings as needed

configure terminal

! Configure SNMP community strings
snmp-server community $SNMP_COMMUNITY RO

! Configure SNMP location and contact
snmp-server location "Data Center"
snmp-server contact "admin@example.com"

! Enable SNMP traps
snmp-server enable traps snmp linkdown linkup
snmp-server enable traps config

EOF
    
    if [ -n "$ZABBIX_SERVER_IP" ]; then
        cat >> /opt/zabbix-snmp-examples/cisco-config-example.txt << EOF
! Configure SNMP host (Zabbix server)
snmp-server host $ZABBIX_SERVER_IP version 2c $SNMP_COMMUNITY

! Create access list for SNMP security
access-list 99 permit $ZABBIX_SERVER_IP
access-list 99 deny any log
snmp-server community $SNMP_COMMUNITY RO 99

EOF
    fi
    
    cat >> /opt/zabbix-snmp-examples/cisco-config-example.txt << EOF
! Save configuration
exit
write memory
EOF
    
    chmod 644 /opt/zabbix-snmp-examples/cisco-config-example.txt
    chown root:root /opt/zabbix-snmp-examples/cisco-config-example.txt
    
    log "${GREEN}Monitoring examples created in /opt/zabbix-snmp-examples/${NC}"
}

# Final verification and information
final_verification() {
    log "${BLUE}[8/8] Final verification and setup information...${NC}"
    
    # Check if SNMP tools are working
    if command -v snmpwalk >/dev/null 2>&1 && command -v snmpget >/dev/null 2>&1; then
        log "${GREEN}✓ SNMP tools installed and available${NC}"
    else
        log "${RED}✗ SNMP tools not found${NC}"
        return 1
    fi
    
    # Display configuration summary
    echo ""
    log "${GREEN}==================== INSTALLATION COMPLETE ====================${NC}"
    log "${GREEN}SNMP monitoring setup completed successfully!${NC}"
    echo ""
    log "${YELLOW}Configuration Summary:${NC}"
    log "• SNMP community string: $SNMP_COMMUNITY"
    log "• SNMP configuration: $SNMP_CONFIG_DIR/snmp.conf"
    log "• Test script: /opt/zabbix-snmp-examples/test-snmp.sh"
    log "• Cisco config example: /opt/zabbix-snmp-examples/cisco-config-example.txt"
    echo ""
    log "${YELLOW}Next Steps:${NC}"
    log "1. Configure SNMP on your network devices using the examples provided"
    log "2. Test connectivity: /opt/zabbix-snmp-examples/test-snmp.sh <device_ip>"
    log "3. Set up Zabbix network discovery rules in the web interface"
    log "4. Import or create SNMP monitoring templates in Zabbix"
    echo ""
    log "${YELLOW}Security Notes:${NC}"
    log "• Change default community strings in production"
    log "• Use SNMPv3 for enhanced security when possible"
    log "• Implement proper ACLs on network devices"
    echo ""
    log "Installation log: $LOG_FILE"
    log "${GREEN}=============================================================${NC}"
}

# Main execution
main() {
    log "${GREEN}Starting Zabbix SNMP monitoring configuration...${NC}"
    
    check_privileges
    detect_distro
    update_packages
    install_snmp_packages
    configure_snmp_client
    configure_firewall
    test_snmp_connectivity
    create_monitoring_examples
    final_verification
    
    log "${GREEN}Zabbix SNMP monitoring setup completed successfully!${NC}"
}

# Run main function
main "$@"