Troubleshooting Tip: Troubleshooting SNMP query failure from the SNMP manager to the firewall

[Anonymous]

Description	This article describes troubleshooting steps to undertake when an SNMP query from the SNMP manager to the firewall fails.
Scope	FortiGate.
Solution	Verify that there are indeed packets being sent from the SNMP manager to the firewall. To do so, run the following CLI command: diagnose sniffer packet any 'host SNMP-manager-ip' 6 0 l After executing this command, send an SNMP query from the SNMP manager to make sure packets are reaching the firewall. If the packets do not reach the firewall, validate the internal network. Packet captures can also be taken from the FortiGate GUI. Refer to the FortiGate packet capture tool GUI. The SNMP manager IP must be added under System -> SNMP -> SNMP V2 or SNMP V3 settings, as shown below: Important: The SNMP community names, user, and authentication/encryption settings in the firewall and the SNMP manager must be the same. For example, in the above SNMP setting, the SNMP community name was configured as 'public', so the same should be defined in the SNMP manager. Note: Using 'public' as the community name for SNMP V1/V2 is not considered safe. The community name 'public' is a default and well-known string, making it vulnerable to unauthorized access. The SNMP should be enabled in the corresponding firewall interface, as shown in the image below:   Additional Debugs: Conduct a debug flow to verify traffic is being accepted:  diagnose debug flow filter addr <Host IP address> diagnose debug flow show iprope enable diagnose debug flow show function-name enable diagnose debug flow trace start <No. of packets to be analyzed> diagnose debug enable   If the traffic is being dropped due to the implicit deny (Failed on policy 0), verify there are no trusted hosts configured under System Administrators. If so, it is necessary to include the SNMP server's IP address.    In addition, verify that the port is open for listening: diagnose sys udpsock | grep 161.   If the above is validated, also check which protocol the SNMP manager is using when the traffic is received. In some instances, collectors may utilize TCP (proto =6), but the firewall, by design, utilizes UDP (proto =17) for SNMP.  Reference for debug flow: Troubleshooting Tip: First steps to troubleshoot connectivity problems to or through a FortiGate wit... Note: Make sure that FortiGate is not relying on a different interface or via a different route. If the problem persists after verifying all of these settings, contact TAC for further support.