SNMP is the language OpManager speaks to your switches, routers, printers and UPS units. Setting it up takes five minutes per device — setting it up carelessly hands network details to anyone on the LAN.
Every performance graph OpManager draws about a network device begins life as an SNMP answer. So the protocol deserves one honest paragraph before the steps: in SNMP v1 and v2c, the community string travels across the network in plain text, and the protocol has no lockout, no encryption and no apology. Anyone who can sniff the wire or guess the string — and “public” and “private” are the first guesses every scanner tries — can read your device’s interfaces, traffic and uptime, and with a read-write string, change its configuration. Treat a v2c community as a weak shared password: necessary on plenty of hardware, never a secret worth trusting. SNMPv3 fixes this properly with per-user authentication and encryption. The pragmatic office rule: v3 wherever the device supports it, v2c done carefully everywhere else — non-default read-only string, accepted only from the OpManager server’s IP.
OpManager supports all three. Your device fleet decides how far up this table you can climb.
There is no single switch to flip for a whole network — SNMP is enabled per device, in that device’s own settings. On managed switches, routers and firewalls it lives in the management or SNMP section of the web console or CLI: turn the agent on, then set the community or v3 user. On Linux servers, install and start the SNMP daemon (snmpd) and edit its configuration to answer your server. On Windows servers, be aware that Microsoft has deprecated the built-in SNMP service in modern Windows versions — most admins monitor Windows through WMI credentials in OpManager instead, and reserve SNMP for network hardware, printers and UPS units, where it remains the native language.
Plenty of real fleets run v2c safely enough on a closed LAN — but only fleets that do all three of these.
public (read) or private (read-write) anywhere; use a long, unique string you invent, different from every password you use elsewhereSNMPv3 replaces the shared string with a named user, an authentication passphrase (choose the SHA family over MD5 where offered) and optional privacy/encryption of the whole conversation. In OpManager you create a matching v3 credential under Settings → Discovery → Device Credentials with the same username and passphrases, and the context name if your device uses one. Two documented traps: the engine ID must be unique on every device — cloned configurations that duplicate it break v3 in confusing ways — and OpManager does not support the AES-192 encryption variant, so select AES-128 privacy on the device if it offers a choice.
With the device side done, open the credential in OpManager and use its test function against one device, or run a single-device discovery and watch the result. Success looks specific: the device lands in the correct category (switch, router, server), its snapshot page shows a real sysDescr, and the CPU/memory/interface monitors start drawing. If the device appears but stays “Unknown”, SNMP did not actually answer — return to the string, the source-IP restriction (did you allow the OpManager server?), and whether UDP 161 is open between them, in that order.
Monitoring rots quietly when the knowledge lives in one person’s head. Keep a short internal record: which devices speak v2c and which speak v3, where the strings are stored (a password manager — never a spreadsheet on a share), and the date each default string was rotated out. When a switch is replaced, the record tells the next admin exactly which credential to re-apply, and the quarterly glance at it is how you discover the printer still running public since 2019.
The setup video shows the credential side inside OpManager — pair it with this page’s device-side steps and both halves of SNMP are covered.
▶️ Watch Full VideoOn a closed office LAN it is commonly acceptable if you do all three basics: a non-default string, read-only access, and the device answering only the OpManager server’s IP. The community still crosses the wire in plain text, so for anything beyond a trusted LAN, use SNMPv3.
Choose AES-128 privacy on the device and in the OpManager credential. It is the widely supported encrypted option and matches what OpManager documents; the unsupported variant simply will not authenticate.
It can, and fleets often do — but then one leaked string exposes every device. At minimum use different strings per device class, store them in a password manager, and let the source-IP restriction carry most of the safety.