SNMP blocked by IPv4 Policy

[Djamil]

Hello guys,

I'm actually working on administrating our Fortigates and monitoring them using LibreNMS.

My problem is with one FortiGate that have an IPv4 Policy with the following configuration :

If I change the destination from the "Virtual IP Group LDLC-redirect-Zyxel" to "ALL", I can add this FortiGate to LibreNMS without any problem, but as soon as I put the Virtual IP Group back, I lose the SNMP pooling.

How can I solve this issue?

[Djamil]

emnoc wrote:

You don't need a fwpolicy to manage a firewall via SNMP.

do a "show interface wan1 | grep allowaccess"

Yes it is enabled on the firewall Interface, I can see the following line : set allowaccess ping https ssh snmp http

As I said before, the problem is not the SNMP but the IPv4 Policy.

emnoc wrote:

You don't need a fwpolicy to manage a firewall via SNMP.

The IPv4 Policy is not for SNMP, it was already in place. The FW is proprietary to our client, the policy was already in place, to describe what I found (look the attached image) :   1- They created two virtual IPs one for TCP and one for UDP 2- They created one Virtual IP Group with the two Virtual IPs 3 - They created the IPV4 Policy shown previously

[emnoc]

We would need to see the 2 vips to better understand but the configuration you have in place seem bad design. The IPv4 policy should have nothing todo with the monitoring of SNMPagent on the fortigate.

Did you run any diag debug flow ?

Ken Felix

[Djamil]

emnoc wrote:

We would need to see the 2 vips to better understand but the configuration you have in place seem bad design. The IPv4 policy should have nothing todo with the monitoring of SNMPagent on the FortiGate.

Did you run any diag debug flow ?

Ken Felix

Yes, I did # diagnose sniffer packet any 'port 161' 4 and I can see traffic coming in from my NMS server to the firewall :

interfaces=[any]

filters=[port 161]

10.520423 port1 in NMS_IP.53260 -> Firewall_WAN_IP.161: udp 45

10.520430 port2 out NMS_IP.53260 -> Firewall_WAN_IP..161: udp 45

11.521459 port1 in NMS_IP.53260 -> Firewall_WAN_IP..161: udp 45

11.521463 port2 out NMS_IP.53260 ->Firewall_WAN_IP..161: udp 45

Note: I replaced the actual real IPs with Firewall_WAN_IP & NMS_IP in this post for the confidentiality of my client.

Here is the firewall policies in place  :

Port1 is the WAN port

Port2 is the LAN port