New Member

Solved

Can't use SNMPv3 on Meraki AP on FortiNAC

Forum|Forum|2 years ago
April 5, 2024
8 replies
7229 views

Hi

We're currently trying FortiNAC v7.2.5.0101, everything runs smoothly for most of our devices except for Meraki AP.

We follow this guide for configuring/adding the AP https://docs.fortinet.com/document/fortinac-f/7.2.0/network-device-modeling/785561/cisco-meraki-ms-switch

Indeed, even though SNMPv3 is enabled on our Meraki oraganization and so AP ( snmpwalk -v3 is ok) FortiNAC always throws an error while trying to add it using S/N as UserName and API Key as Password as you can see below:

From a firewall perspective we got not deny or any filtering, proof is we can add the same AP using SNMPv2c for instance.

From a FortiNAC perspective, there's no such log or information that may helps to troubleshoot this.

Any of you guys succeed to use SNMPv3 between FortiNAC and Meraki ?

Thanks a lot for your help & advices

FortiNAC

Best answer by motorbass

I finally found the solution from here https://support.auvik.com/hc/en-us/articles/204356740-How-to-enable-SNMP-on-Meraki-devices

So credentials to use are those from Network-wide, we agree, but in any case, it has to be SHA1 & DES.

It works pretty smooth, happy to have learnt something today ! :)

ozkanaltas

Valued Contributor III

Hello @motorbass ,

I think it's related to SNMP_Protocol. Can you change SNMP_Protocol with SNMPv3 AuthNoPriv.

Or you need to fill the privacy password area with the password.

motorbassAuthor

New Member

Hi

Just gave a try and same error.

UserName is still S/N and Authentication Password is my API Key

ozkanaltas

Valued Contributor III

Hi @motorbass ,

Firstly you need to add a Meraki device with snmp credentials. You can configure this credential on a Meraki device.

SNMP  Configure SNMP access to allow for FortiNAC device discovery. Under the Network-wide > General > SNMP section, allow either v1/v2 or v3 access

After adding the Meraki device on FortiNAC, you can configure the username and API key in the model configuration menu on FortiNac

But first, you need to add the Meraki device to FortiNac with SNMP credentials.

I found one document about how to configure SNMPv3 credentials on the Meraki MS switch. You can review this document.

https://support.auvik.com/hc/en-us/articles/204356740-How-to-enable-SNMP-on-Meraki-devices

ndumaj

Staff

Hello,
According to the Error, FNAC sends SNMPv3 requests to get sysobjectID from the device but the switch does not respond with the appropriate parameters and FNAC states -> "Unable to contact"
It looks to be a misconfiguration of SNMPv3.
Article:
https://community.fortinet.com/t5/FortiNAC/Technical-Tip-Troubleshooting-SNMP-communication-issues/ta-p/198137

Check on Meraki if there is any indication why it is refusing the FNAC request.

BR

motorbassAuthor

New Member

I'm on FNAC 7.2 so I don't have access to the previous and real linux shell, but only to the "forti" layer shell.

From another server, the snmpwalk -v3 to my Meraki AP is working as mentionned earlier.

ozkanaltas

Valued Contributor III

Hello @motorbass ,

Fortinac can access the switch IP address, right?

ndumaj

Staff

Additional information:
https://community.fortinet.com/t5/FortiNAC/Technical-Note-Permission-requirements-for-modeled-devices/ta-p/193566

Also please what is the OID of Meraki?

BR

motorbassAuthor

New Member

Hi, i'm currently reading both of your doc

OID is :

iso.3.6.1.2.1.1.2.0 = OID: iso.3.6.1.4.1.29671.2.22

motorbassAuthor

New Member

It seems privKey is not well interpreted (don't know if it's from fnac or Meraki) but both are actually communicating

EDIT:

Got the same kind of flows and messages no matter if i use S/N + API key OR the AuthKey Privkey

ozkanaltas

Valued Contributor III

You can review this article about privKey Unknow.

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0748756

ndumaj

Staff

Can you try with another protocol and simple PSK?

BR

motorbassAuthor

New Member

Just tried for instance with only SHA25 - SNMPv3 AuthNoPriv andresult is same but wireshark changes a little bit.

In any case, frame details got some missing parameters so I guess FNAC or Meraki doesn't seems to "talk the same way"

ozkanaltas

Valued Contributor III

Can you share the Meraki snmp setting with us?

motorbassAuthorAnswer

New Member

I finally found the solution from here https://support.auvik.com/hc/en-us/articles/204356740-How-to-enable-SNMP-on-Meraki-devices

So credentials to use are those from Network-wide, we agree, but in any case, it has to be SHA1 & DES.

It works pretty smooth, happy to have learnt something today ! :)

ozkanaltas

Valued Contributor III

I'm glad it worked. However, I shared this document in my first messages. I guess you didn't read :)

motorbassAuthor

New Member

Hi, i'm so sorry ,indeed you mentionned the url, however my workmate told me he already tried this url that's why I misclick. But thanks again for your help, i do really appreciate it :)

ndumaj

Staff

I'm glad to hear that it worked.
Well done!

BR

motorbassAuthor

New Member

Thanks a lot for your help ! :)

Sign up

Login with SSO

Login to the community

Login with SSO