Technical Tip: SNMP polling/snmpwalk not working: Important points need to be considered when configuring SNMP in FortiGate

If the SNMP has been configured and the snmpwalk has not been received successfully, refer to the points below that must be considered when configuring SNMP in FortiGate.

• Check in which interface of FortiGate the SNMP request is sent. Make sure the SNMP service is enabled on that interface.
•  If the trusthost is configured under administrator settings, make sure the snmpserver IP is configured as the trusthost under the administrator settings.

Refer to the link below to understand how to add the device to TrustHost under the administrator settings:
Technical Tip: System administrator best practices

• If the HA direct is enabled, make sure the SNMP service is enabled on that dedicated management interface.
• If the HA dedicated management port is configured, make sure to have ha-direct enabled under the SNMP setting. Refer to Technical Tip: How to Configure FortiGate SNMP Agent for Monitoring for steps to enable ha-direct under SNMP settings.
• Make sure that SNMP sysinfo is enabled in the configuration:

config system snmp sysinfo
    set status enable

• For FortiOS below v7.6, if multi-VDOM is enabled, the target interface should be under the management VDOM to get the response from the SNMP poll.

Refer to the article Technical Tip: Configuring SNMP when VDOM is enabled for more information.

If there is still an issue,  collect the logs below and share them with the TAC:

Terminal 1:

diagnose sniffer packet any "host x.x.x.x and port 161" 6 0 l <----- x.x.x.x=snmp server IP address.

Terminal 2:

diagnose sniffer packet any "host x.x.x.x and port 161" 4 0 l <----- x.x.x.x=snmp server IP address.

Terminal 3:

get router info routing-table details x.x.x.x <----- x.x.x.x=snmp server IP address.

Terminal 4:

diagnose debug application snmpd -1
diagnose debug enable

Now, perform snmpwalk from the snmpserver. Once the error message appears in the snmpserver, stop the above debug using the following command:

For terminal 1 and terminal 2:
Press Ctrl+C.

For terminal 4:

diagnose debug disable

SNMP walk counter behavior on FortiGate non-management VDOM interfaces.

When performing an SNMP Walk operation on a FortiGate device, it is important to note that interface counters will not increment (remaining at zero) if the SNMP request is initiated through an interface bound to a non-management VDOM.

Details:
If an SNMP Walk request is issued via a FortiGate interface located within a VDOM other than the root or management VDOM, the operation may successfully establish a connection with the SNMP server. However, the interface counters retrieved by the SNMP Walk will still display a value of zero. This occurs because the SNMP agent operates within the root or management VDOM, which is solely responsible for processing and responding to SNMP requests.

For example, if a VLAN interface is configured within VDOM B but is physically bound to an interface in VDOM A (the root or management VDOM), FortiGate can maintain connectivity between the VLAN interface and the SNMP server. Nonetheless, when an SNMP Walk is executed using the VLAN interface in VDOM B as the source, the counters will not increment.

This is due to the fact that all SNMP Walk requests and responses are managed by the root or management VDOM interface. The SNMP agent, residing in the root or management VDOM, holds the monitoring data for all VDOMs, including VDOM B, but does not expose counter values for interfaces outside the management domain through non-management interfaces.

The root or management VDOM acquires interface updates from other VDOMs via inter-VDOM links and is exclusively responsible for responding to the SNMP manager. Consequently, SNMP Walk operations directed through non-management VDOM interfaces will not reflect accurate counter data.