SNMP Fortigate : timeout - not responding

[Nco_L]

Hello,

I would like to request information from my Fortigate via the SNMP protocol, so I configured the protocol, community etc. on the web interface, then activated the protocol on an internal interface to make it operational.

However, I have no answer from my Fortigate during the requests: Timeout,...

Thank you for your help.

[Druss]

Are you using VDOM? If so the management VDOM is root…

"To get SNMP working with VDOM enabled: 

Make sure that the interface where the SNMP collector connects to is part of the management VDOM.

This can be fixed in two ways

[ol]

Making sure that the VDOM the SNMP interface is configured for on fortigate is the management vdom by changing the management vdom. FGT # config global FGT (global) # config system global FGT (global) # set grep management-vdom

Using an interface that belongs to default "root" vdom for SNMP traps"[/ol]

[Nco_L]

Thank you for your quick answer, but we do not use in VDOM in our current configuration.

[rwpatterson]

Do you have trusted hosts defined? If so, is the SNMP server in that list?

[Nco_L]

My SNMP server is not declared as a trusted host but trusted hosts are not reserved only for users?

Because I would like to use Centreon to send SNMP requests, so I don't connect to the Firewall.

(I use SNMP version 2c)

[rwpatterson]

I may be wrong on this, but once you start entering into the trusted hosts, all firewall access will be restricted by those allowed hosts/subnets. Someone correct me if I am wrong. I don't use them myself since I never know where I will need to be supporting from.

If you are using trusted hosts, simply as a test add your SNMP server to the list. Quick and easy test.

[Nco_L]

yes I understand, however, as mentioned above, I don't think that trusted hosts is a real impact on my problem because the action you are proposing to me is to add a new administrator of some kind.

[BrianB · Accepted solution]

If you have trusted hosts enabled at all, then you will need to add the IP of your polling/trap server as a trusted host.

I just went through this yesterday.

[Nco_L]

Thank you for your answer, I'll test this right away.

[Nco_L]

I've tested it and unfortunately, it doesn't work either.