FortiGate 90D not sending SNMP Info for Interfaces

[rileysj2]

Hello,

I have 3 FortiGate 90Ds, one is an HA pair, and the third is a SECONDARY in an HA pair.

For some reason, they are not sending SNMP information to our Solarwinds monitoring platform.  All of our other FortiGates are.

It's strange that 1 out of 2 in an HA pair is not sending the information.  All of our FortiGates are configured with 'ha-direct enable' to allow us to monitor interfaces from the management IP's.  But for some reason, these 3 will not send the SNMP info.  All configurations are identical.

Has anyone seen anything like this before?

[emnoc]

Qs:

Did you run any diag debug  flow against the devices?

diag sniffer packet on the unit that fails ( not sure if you can select the management interface ) ?

ken

[rileysj2]

Ken,

I did not.  Forgive my ignorance, but I'm sort of new to this.

What should I run exactly and will there be any impact to the production devices and users connected to them?

Thanks,

Stan

[emnoc]

On the unit that does not  reply

do something of the followig

1>

FWCORNYC1 (root) $ diag sniffer packet  mgmt  "port 161" interfaces=[mgmt] filters=[port 161] 2.885783 172.17.17.12.50939 -> 192.168.77.11.161: udp 127 2.886098 192.168.77.11.161 -> 172.17.17.12.50939: udp 159 2.888483 172.17.17.12.50939 -> 192.168.77.11.161: udp 127 2.888737 192.168.77.11.161 -> 172.17.17.12.50939: udp 159 2.897823 172.17.17.12.50939 -> 192.168.77.11.161: udp 127 2.898012 192.168.77.11.161 -> 172.17.17.12.50939: udp 149 2.899051 172.17.17.12.50939 -> 192.168.77.11.161: udp 127 2.899297 192.168.77.11.161 -> 172.17.17.12.50939: udp 159 2.900034 172.17.17.12.50939 -> 192.168.77.11.161: udp 127 2.900279 192.168.77.11.161 -> 172.17.17.12.50939: udp 159 2.901018 172.17.17.12.50939 -> 192.168.77.11.161: udp 127 2.901261 192.168.77.11.161 -> 172.17.17.12.50939: udp 159 2.902001 172.17.17.12.50939 -> 192.168.77.11.161: udp 127 2.902332 192.168.77.11.161 -> 172.17.17.12.50939: udp 147 2.903229 172.17.17.12.50939 -> 192.168.77.11.161: udp 127 2.903477 192.168.77.11.161 -> 172.17.17.12.50939: udp 159 2.904212 172.17.17.12.50939 -> 192.168.77.11.161: udp 127 2.904457 192.168.77.11.161 -> 172.17.17.12.50939: udp 159 2.905195 172.17.17.12.50939 -> 192.168.77.11.161: udp 127 2.905441 192.168.77.11.161 -> 172.17.17.12.50939: udp 159 20 packets received by filter 0 packets dropped by kernel

2>

 diag debug flow filter addr x.x.x.x  diag debug flow filter port 161   diag debug flow show console  en   diag debug en   diag debug flow trace start 10

Ken

[emnoc]

And here's how a unit  looks

config system interface     edit "mgmt"         set ip 192.168.77.11 255.255.255.0         set allowaccess ping https ssh snmp fgfm         set type physical         set dedicated-to management         set description "OOB MGMT LAN"         set listen-forticlient-connection enable         set snmp-index 49     next end

  config system ha     set group-name "CRPFWCLUSTER6"     set mode a-p     set password ENC  xxxxxxxxxxxx     set hbdev "port3" 50 "port4" 50     set session-pickup enable     set ha-mgmt-status enable     set ha-mgmt-interface "mgmt"     set ha-mgmt-interface-gateway 192.168.77.1     set override enable     set priority 129     set monitor "AE1" "AE2" "AE3" "AE4" end

[rileysj2]

So after looking closely at the HA and SNMP config across the devices and comparing it to the one 90D that DOES work, the only difference from the working 90D is that the working 90D has 2 commands 'set hb-interval 1' and 'set priority 120', everything else is identical.