SNMP "no response" from gateway on the other side of IPSEC tunnel - What's the secret?

Forum|Forum|3 years ago
March 20, 2023
2 replies
4005 views

Hi All,

I have a central 100F and a small number of 60E's in regional offices. 60E's connect back to the 100F via IPSEC tunnels. I'm trying to monitor the 60E's via SNMP.

Key points:

IPSEC setup using default static FG-FG tunnel template.

VDOM is not being used at either end.

Specific rules have been setup for testing allowing essentially ANY/ANY for SNMP and ICMP to and from both ends.

SNMP is enabled on the interface at the remote site.

Tunnels have performed well for 2+ years and I can fire anything I need across it. (ie, DNS and Routing seem fine).

Community has been set, along with ACL (which has also been removed and tested).

I have extensive SNMP checks all over my networks which are working fine (ie, this isn't my first rodeo).

Result:

I can ping the remote interface gateway.

SNMPGET and WALK returns "no response" (commands tested locally work fine).

I can SNMPGET a bunch of other devices on that remote subnet and it works. When directing SNMP to the remote gateway, I can see the packets leave the 100F and arrive on the 60E but they just seem to stop. The behaviour is the same on all of my remote 60E's so I feel like I'm missing a FG specific switch somewhere.

Any help appreciated.

FortiGate

Best answer by ESIT

Sorry I didn't explain that very well in frustration.

System --> Administrators --> Give any user the IP of the SNMP Host

From what I read elsewhere, if you have used ACL's at the admin account level they will be checked first, then the SNMP host. I have confirmed this is the behaviour I am experiencing.