SNMP V3 ERROR ABOUT CISCO SWITCH

[SamK0]

Hello everyone,
I am working with FortiNAC-F 7.4 and I have imported a Cisco Catalyst switch v3. The ports on the switch are in VLANs. I can read them on the device, but the problem is that I cannot retrieve certain endpoints on the ports. When I check the events on FortiNAC, I receive an error:

SNMP Failure SNMP failed for device SW-INFO with message SNMP getNext/getBulk Failed for device: 10.30.5.0.2

Can you please help me?

FortiNAC 

[AEK]

Hi Sam

When you click "Validate credentials" for the device, is it successful?

Do you get a correct answer when you try snmpwalk (with SNMPv3) from FNAC CLI?
E.g.:

snmpwalk -v3 -u fnac -l AuthPriv -a sha -A <AuthPass> -x aes 128 -X <EncPass> 10.30.5.2

[SamK0]

Hi AEK,

yes i receive a successful notification. But on FNAC cli, i cannot use snmpwalk command directly: It's not recognise on FortiOS . But When i use diagnose command for snmp walk, i can read all switch OID. 

[ebilcari]

You can still run the snmpwalk command in NAC-OS after entering shell access:

fnacl74 # exe enter

fnacl74:~$ snmpwalk
USAGE: snmpwalk [OPTIONS] AGENT [OID]

You can gather more information by enabling the SNMP debug:

# diagnose debug plugin enable SnmpV1

# diagnose debug plugin list-debug-enabled

# diagnose tail output.master -f | grep Snmp

In the end don't forget to disable the debug:

# diagnose debug plugin disable SnmpV1

Usually this problems are solved by finding a compatible Authentication/Privacy protocol between the switch and FNAC.

[SamK0]

Hi Ebilcari,
I can now use this command and it works correctly, I can read OID on switch.
Thanks a lot.

[ebilcari]

Are you still facing issues with the host status update for connected hosts in switch?

There are two methods that FNAC uses to update the host for this switch type:

- SNMP MAC notification traps, (not directly related to SNMP query) that need to be configured in the switch.

- L2 polling, FNAC access the switch via CLI, get the output of the MAC address table and parses it.

[SamK0]

Hi Ebllcari,
The problem I'm having now is that I can't read the IPs of the endpoints connected to the fortinac. The IP I see is only that of the switch interface.
Do you have any idea how to solve it ?

[ebilcari]

The IP of the hosts are learned through reading the ARP table of the managed network devices. The ARP table is populated on the network device where the gateway of the users resides. If the hosts have the GW in another L3 device you have to add it to be managed by FNAC in order to get this visibility.

[AEK]

Can you share the SNMPv3 related config of the switch used for FNAC? (you can hide IP addresses and passwords).

Can you also try with SNMPv2 and see if it works? (just for test purpose).

[SamK0]

Hi AEK, 
below SNMP config: 

NB: the ports are in vlans other than the default vlan.
On the ports I've enabled: "snmp trap mac-notification added" and "snmp trap mac-notification removed".