Technical Tip: How to perform queries using SNMPv3 to non-management VDOMs

[syordanov]

Description	This article describes how to perform queries using SNMPv3 to non-management VDOMs.
Scope	FortiGate v7.6.0, SNMPv3.
Solution	When FortiGate is configured in multi-VDOM mode, SNMP queries can only be performed for a management VDOM. FortiOS v7.6.0 introduced a new feature that allows non-management VDOMs to answer SNMPv3 queries.   The root VDOM is acting as a management VDOM. The vdom_1 is a non-management VDOM. Port wan1 with IP address 10.191.20.48 belongs to vdom_1. When the SNMP station performs an SNMPv3 query, FortiGate does not respond. FortiOS 7.6.0 GA introduced a new feature that allows to do SNMPv3 queries to non-management VDOM, this can be adjusted using the following CLI commands: config global     config system snmp sysinfo         set non-mgmt-vdom-query enable end The default value for 'non-mgmt-vdom-query' is disabled. Once enabled, non-management VDOMs can respond to SNMPv3 queries. Keep in mind that the 'snmp' needs to be allowed under the interface which the SNMP station queries. config system interface     edit "wan1"         set vdom "vdom_1"         set ip 10.191.20.48 255.255.240.0         set allowaccess ping https ssh snmp http telnet         set type physical         set role wan         set snmp-index 3     next end Before the change: diagnose sniffer packet any " host 10.191.19.9" 4 interfaces=[any] filters=[ host 10.191.19.9] 2.897778 wan1 in 10.191.19.9.51772 -> 10.191.20.48.161: udp 42 3.898823 wan1 in 10.191.19.9.51772 -> 10.191.20.48.161: udp 42 4.899998 wan1 in 10.191.19.9.51772 -> 10.191.20.48.161: udp 42 5.901203 wan1 in 10.191.19.9.51772 -> 10.191.20.48.161: udp 42 After implementing the change: diagnose sniffer packet any " host 10.191.19.9" 4 interfaces=[any] filters=[ host 10.191.19.9] 2.079355 wan1 in 10.191.19.9.40236 -> 10.191.20.48.161: udp 64 2.079424 wan1 out 10.191.20.48.161 -> 10.191.19.9.40236: udp 127 2.080096 wan1 in 10.191.19.9.40236 -> 10.191.20.48.161: udp 129 2.080124 wan1 out 10.191.20.48.161 -> 10.191.19.9.40236: udp 141 For troubleshooting, collect the below debug command output: Putty1: diagnose debug application snmpd -1 diagnose debug console timestamp enable diagnose debug enable To disable debug after logs collection : diagnose debug disable diagnose debug reset Putty2: diagnose sniffer packet any "port 161 or port 162" 6 0 l Related document: Non-management VDOMs perform queries using SNMP v3