We’ve all seen it. That file sitting on the network share with mostly inaccurate information about every device on the network. It’s probably a spreadsheet, but if you’re really lucky, it’s a WordPerfect document from 1999 that some guy your dad’s age refuses to give up. The same guy who records a unique voicemail each morning to let everyone know he made it into work.

The file also has 18 copies because only one person can edit it at a time:

Subnet_10.wpd
Subnet_10(copy).wpd
Subnet_10(copy copy).wpd
Subnet_10_FINAL.wpd
Subnet_10_FINAL_v2.wpd

All unique snowflakes, but in a bad way. And your inbox is full of these:

“Can whoever has Subnet 10 Document open PLEASE CLOSE IT!”

Like it’s your fault they can’t get anything done.

Knowing what’s on your network is half the battle when it comes to securing it. You need a tool that:

  1. Is web-based (accessible from anywhere)
  2. Updates itself via network discovery
  3. Audits who changes what

phpIPAM checks all three boxes. It’s free, open source, and actually works. This guide covers setting up SNMPv3 discovery so phpIPAM can automatically find and catalog devices on your network.

Prerequisites

This guide assumes: - phpIPAM already installed and running (RHEL 9 or similar) - A managed switch or router with SNMPv3 support - Basic familiarity with network concepts

Install SNMP Support

First, install PHP SNMP support on your phpIPAM server:

1
2
3
4
5
6
7
# RHEL/Rocky/Alma
dnf install php-snmp -y
systemctl restart php-fpm

# Debian/Ubuntu
apt install php-snmp -y
systemctl restart apache2

Enable SNMP in phpIPAM

Navigate to Administration → Settings and enable the SNMP module. Save your changes.

Configure Your Network Device

Log into your switch or router and configure SNMPv3. This example uses Cisco IOS syntax, but the concepts apply to any vendor.

Create an SNMP View

Define what OIDs phpIPAM can access:

Switch> enable
Switch# configure terminal
Switch(config)# snmp-server view IPAM_VIEW iso included

This grants access to the entire ISO tree. For tighter security, limit to specific OIDs like 1.3.6.1.2.1 (MIB-2).

Create an SNMP Group

Switch(config)# snmp-server group IPAM_GROUP v3 priv read IPAM_VIEW

This creates a group using SNMPv3 with authentication and privacy (encryption).

Create an SNMP User

Switch(config)# snmp-server user ipam_user IPAM_GROUP v3 auth sha AuthPassword123 priv aes 128 PrivPassword456

Replace the passwords with something secure. This creates a user with: - Authentication: SHA (more secure than MD5) - Privacy: AES-128 encryption

Verify Configuration

Switch# show snmp user
Switch# show snmp group

Configure phpIPAM Discovery

Back in phpIPAM:

  1. Go to Administration → Discovery → SNMP

  2. Add a new SNMP credential set: - Name: Network Devices - Version: v3 - Security Level: authPriv - Auth Protocol: SHA - Auth Password: AuthPassword123 - Privacy Protocol: AES - Privacy Password: PrivPassword456 - Username: ipam_user

  3. Go to Subnets and select a subnet to scan

  4. Click Scan subnet → Discovery scan
  5. Select your SNMP credentials and run the scan

phpIPAM will query devices via SNMP and populate hostname, MAC address, and other details automatically.

Scheduling Automatic Discovery

Set up recurring scans to keep your inventory current:

  1. Administration → Scheduled jobs
  2. Add a new discovery job for each subnet
  3. Set the schedule (daily is usually sufficient)

For CLI-based scheduling, add a cron job:

1
2
# Run discovery every night at 2 AM
0 2 * * * /usr/bin/php /var/www/html/phpipam/functions/scripts/discoveryCheck.php

Troubleshooting

No devices found: - Verify SNMP connectivity: snmpwalk -v3 -u ipam_user -l authPriv -a SHA -A AuthPassword123 -x AES -X PrivPassword456 <switch_ip> system - Check firewall rules (UDP 161) - Verify credentials match exactly

Partial information: - Expand the SNMP view on the network device - Some devices require specific OID access for MAC/ARP tables

Timeouts: - Increase timeout values in phpIPAM SNMP settings - Check for network latency or packet loss

Why SNMPv3?

SNMPv1 and v2c transmit community strings in plaintext. Anyone with a packet capture can read your credentials and query your entire network. SNMPv3 provides:

  • Authentication: Verify the request source
  • Encryption: Protect data in transit
  • Access control: Granular permissions per user

There’s no reason to use v1/v2c on a modern network.

Wrapping Up

Once configured, phpIPAM becomes your single source of truth for IP management. No more spreadsheets, no more “who has this document open” emails, no more guessing what’s on the network.

The SNMPv3 discovery runs automatically, keeps your inventory current, and maintains an audit trail of every change. Your future self will thank you.