Technical Tip: SNMP traffic blocked due to a local-in policy violation

While troubleshooting SNMP connectivity issue between SNMP Manager (Network Management System) and SNMP agent (FortiGate), the debug flow highlights that traffic is getting dropped due to 'iprope_in_check() check failed on policy 0, drop' message.

id=65308 trace_id=110 func=print_pkt_detail line=5813 msg="vd-root:0 received a packet(proto=17, 10.10.3.6:54923->10.10.1.11:161) tun_id=0.0.0.0 from port1. "

id=65308 trace_id=110 func=init_ip_session_common line=5997 msg="allocate a new session-00f3d090" id=65308 
trace_id=110 func=vf_ip_route_input_common line=2611 msg="find a route: flag=84000000 gw-10.10.1.11 via root" 
id=65308 trace_id=110 func=__iprope_tree_check line=539 msg="gnum-100004, use addr/intf hash, len=74" 

id=65308 trace_id=1304 func=__iprope_check_one_policy line=2243 msg="policy-4294967295 is matched, act-drop"
id=65308 trace_id=1304 func=__iprope_check line=2290 msg="gnum-10000f check result: ret-matched, act-drop, flag-00000801, flag2-00000000"
id=65308 trace_id=1304 func=iprope_policy_group_check line=4694 msg="after check: ret-matched, act-drop, flag-00000801, flag2-00000000"
id=65308 trace_id=110 func=fw_local_in_handler line=606 msg="iprope_in_check() check failed on policy 0, drop"

In order to troubleshoot the issue, the first and foremost step would be to verify if SNMP is enabled on the interface on which traffic is received ('port1' in above debug flow).

If SNMP is enabled on interface, make sure that the trusted hosts include the IP address of SNMP Manager (10.10.3.6 in above debug flow).

To resolve the SNMP traffic policy violation issue, follow these steps:

1. Go to System -> Administrator -> Select the admin user.
2. Add the SNMP collector IP address to the Trusted Host configuration. For example, SNMP Manager has IP address 10.10.3.6. Add 10.10.3.6/32 to the trusted host list. The IP address of SNMP Manager must be part of any admin accounts.
3. Save the changes and verify that the SNMP traffic is no longer blocked.

CLI:

config system admin
    edit "admin"
        set trusthost1 10.10.3.6 255.255.255.255
        set accprofile "super_admin"
        set vdom "root"
    next
end

By adding the SNMP collector IP to the trusted host configuration, the SNMP traffic policy violation issue is resolved, and  SNMP polling works.

Related articles::

Technical Tip: SNMP access to FortiGate 

Troubleshooting Tip: Debug flow messages 'iprope_in_check() check failed, drop' - 'Denied by forward policy check' - 'reverse path check fail, drop' - 'iprope_in_check() check failed on policy 0, drop' 

Technical Tip: Impact of Local-In Policies and Trusted Hosts Configuration on FortiGate Access 

Troubleshooting Tip: FortiGate HTTPS, SSH access if the trusted hosts feature is enabled