Docs Get started

Configure the collector

Tell Lantern which devices to poll, with which SNMP credentials, and which subnets it may discover.

The collector reads its configuration from snmp.json in its data folder. The first start writes an example and stops, so you can fill it in. Restart Lantern after every change.

An example

{
  "site": "Head office",
  "name": "Northwind Logistics",
  "interval_s": 300,
  "credentials": [
    {"name": "site-v3", "version": "3", "user": "lantern-ro",
     "auth_proto": "SHA", "auth_pass": "your-auth-passphrase",
     "priv_proto": "AES", "priv_pass": "your-privacy-passphrase"},
    {"name": "legacy-v2c", "version": "2c", "community": "your-community"}
  ],
  "devices": [
    {"address": "10.10.99.1"},
    {"address": "10.10.99.2", "credential": "legacy-v2c"}
  ],
  "discover": ["10.10.99.0/24"],
  "syslog": "0.0.0.0:514"
}

Settings

Key Meaning
site, name The site and customer names shown at the top of every page and on reports.
interval_s Seconds between poll cycles (minimum 15). Production collectors usually poll every 2 to 5 minutes; loops are confirmed from syslog as they happen, whatever the interval.
timeout_s, retries Per request: wait this long (default 5 s) and retry this many times (default 1).
credentials SNMP credential profiles (below).
devices Seed devices: at least your core switch and firewall.
discover Subnets Lantern may add devices from. A neighbour seen through LLDP or CDP is added when its management address is inside one of these. Phones and hosts are never added.
syslog UDP address to listen on for syslog, such as 0.0.0.0:514. Leave it out to turn syslog off; Lantern then cannot confirm loops, only show possible ones.

Credential profiles

Key Values
name Any name; devices refer to it.
version "3" (recommended) or "2c"
community SNMP v2c community
user SNMPv3 user name
auth_proto, auth_pass MD5, SHA, SHA224, SHA256, SHA384 or SHA512, and the passphrase. Leave out for no authentication.
priv_proto, priv_pass DES, AES, AES192, AES256, AES192C or AES256C, and the passphrase. Leave out for no privacy.

Devices

Key Meaning
address Management IP address or DNS name.
credential The profile to use. Without it, Lantern tries each profile in order and keeps the first that answers.
id A fixed device ID. By default it comes from the device's name (sysName).
port SNMP port if not 161.

Secrets are encrypted

Passwords and communities you type into snmp.json in plain text are encrypted the next time Lantern starts, and the file is rewritten with "enc:…" values. The key is credentials.key in the same folder. Keep the key with the data and never copy it between customers.

To change a secret later, replace its "enc:…" value with the new plain-text value and restart.

Prepare your devices

Give Lantern a read-only SNMP view, restricted to the collector's address. On Cisco IOS and IOS-XE, for example:

ip access-list standard LANTERN-ACL
 permit host 10.10.99.50
snmp-server view LANTERN iso included
snmp-server group LANTERN-RO v3 priv read LANTERN access LANTERN-ACL
snmp-server group LANTERN-RO v3 priv context vlan- match prefix read LANTERN access LANTERN-ACL
snmp-server user lantern-ro LANTERN-RO v3 auth sha <auth-passphrase> priv aes 128 <privacy-passphrase>
lldp run
logging host 10.10.99.50
logging source-interface Vlan99

The context vlan- line lets Lantern read the MAC table of each VLAN on Cisco switches (Cisco keeps one bridge table per VLAN). logging source-interface is recommended but not required: Lantern matches syslog to devices by any of their addresses.

On other vendors, the equivalent is: an SNMPv3 user with authentication and privacy on a read-only view of the whole tree, an access list allowing only the collector, LLDP enabled on every switch, and syslog sent to the collector.

Check it worked

Restart Lantern and open Settings › General. The Polled devices table shows each device, the credential profile that answered, the last poll and any error. See Check collection.