SNMP no response: timed out

[luca1994]

Hello team,

I configured snmp.

I enabled snmp in the management interface, after which I went under "System > SNMP" and configured as follows:

When test with snmpwalk command via cli from my monitoring system, Fortigate side capture this traffic:

it is as if the fortigate is not responding to snmp traffic. Maybe some policy is missing?

Thanks for the support

BR

[syordanov]

Dear luca1994,

I hope you are doing well.
Can you try to run the following commands when your monitoring does snmpwalk :

SSH No1:

diagnose debug reset
diagnose debug disable
diagnose debug flow trace stop
diagnose debug flow filter clear
diagnose debug flow show iprope enable
diagnose debug flow show function-name enable
diagnose debug flow filter daddr x.x.x.x <---- where x.x.x.x is the IP address of your mgmt interface
diagnose debug console timestamp enable
diagnose debug flow trace start 200
diagnose debug enable

SSH No2:

diag sys session filter dst x.x.x.x <---- where x.x.x.x is the IP address of your mgmt interface
diag sys session filter dport 161
diag sys session list
diag sys session clear
diag sys session list

Check if the traffic from your monitor station is dropped by policy - 0 deny or reverse patch fail check .

Regards,

Fortinet

[funkylicious]

If you are using trusted hosts for your firewall administrators to log in, you would need to add this ip of the snmp query server to one of them.

[AEK · Accepted solution]

Hello Luca

If your host is not in the same VLAN as your mgmt interface, they yes you have to add a firewall policy as follows:

• Source interface: Interface from which the host is sending SNMP query (in your case I think it is VPN)
• Source IP: Host
• Destination interface: mgmt
• Destination IP: mgmt IP

In case your mgmt interface is "dedicated for management", then I think you will not be able to add this policy, so I think you will have to enable SNMP on another firewall interface.

[luca1994]

Hello @AEK ,

thank you for your response.
So not being able to do policy on the management interface it is mandatory to configure snmp on another interface and then allow this traffic via policy.
Does the same thing apply if the firewall is in HA A-P?

BR

[AEK]

Hi Luca

Yes it is same for HA A-P.

[luca1994]

Hello @AEK ,

just out of curiosity , what is the utility of enabling snmp on management interface?

Thanks

BR

[AEK]

Hi Luca

Personally I usually enable it on the interface which is on the same vlan as the monitoring server.

It is not mandatory to enable it on management interface, but I guess on mgmt interface it just have some natural logic.

[luca1994]

Hello AEK,

is safe enabling SNMP on WAN interface?

Thank you

BR

[AEK]

Hi Luca

This is not safe.