cannot query snmp

[alain]

Hi,

we have a fortigate HA pair 5.6.6 = FG200E-5.6.6-FW-build1630-180913

We would like to poll snmp by the mgmt interface 172.16.11.135 from 172.16.1.104.

Ping is ok

snmp is enable on the mgmt interface

host ip is defined

but snmp v1,v2 or even does not work at all.

Here is the debug log :

snmpd: request 1(root)/4/172.16.1.104 == comm 1/0/172.16.1.104/255.255.255.255 snmpd: matched community "public" snmpd: get-next: ifXEntry.1 -> () -> 0 snmpd: </msg> 0

snmpd: <msg> 44 bytes 172.16.1.104:7423 -> 172.16.11.135/172.16.11.135:161 (itf 4.4) snmpd: checking if community "public" is valid snmpd: checking against community "public" snmpd: request 1(root)/4/172.16.1.104 == comm 1/0/172.16.1.104/255.255.255.255 snmpd: matched community "public" snmpd: get-next: ifXEntry.1 -> () -> 0 snmpd: </msg> 0

snmpd: <msg> 44 bytes 172.16.1.104:7423 -> 172.16.11.135/172.16.11.135:161 (itf 4.4) snmpd: checking if community "public" is valid snmpd: checking against community "public" snmpd: request 1(root)/4/172.16.1.104 == comm 1/0/172.16.1.104/255.255.255.255 snmpd: matched community "public" snmpd: get-next: ifXEntry.1 -> () -> 0 snmpd: </msg> 0

[Dave_Hall]

This may sound silly, but is the SNMP agent enabled?

[alain]

yes snmp is enabled with a community name v1/v2c. Tried with v3 without luck.

[ChristianM]

Hi,

do you have "trusted hosts" in the admin account defined?

Is the queriing server listed there?

Routing back to the server correct?

172.16.1.104 is routed through mgmt-interface?

If not, a policy is needed, to allow traffic from incoming interface to mgmt-interface

Chris

[alain]

do you have "trusted hosts" in the admin account defined?

>> yes hosts are trusted for SNMP and adding them in admin account for login changes nothing.

Is the queriing server listed there?

>> yes

  Routing back to the server correct? 

>> ping the IP of mgmt interface is OK so I suppose it is correct ?

172.16.1.104 is routed through mgmt-interface? If not, a policy is needed, to allow traffic from incoming interface to mgmt-interface >> 172.16.1.104 is the SNMP host that  is trying to poll snmp with the IP adress of management interface. 

>> Do I miss something ?

Alain 

[ChristianM]

Hi Alain,

>> Do I miss something?

Yes ;) But what...

Please check (again) if the "SNMP Agent"-slider in the SNMP-page is "on". Even if the page

says "v2c Enabeld", you have to enable the agent extra.

[Dave_Hall]

Initially, when we started to play around with snmp monitoring, we were on 5.0/5.2 but never fully got it working.  On 5.4, we used the CLI to config snmp and was reported to be working (with our network monitoring tools).

config system snmp sysinfo set status enable set description "test.fortiddns.com" set contact-info "admin@test.ca" set location "Test" end config system snmp community edit 1 set name "public" config hosts edit 1 set ip 222.188.66.126 255.255.255.255 set interface "wan1" next end set events cpu-high mem-low log-full intf-ip vpn-tun-up vpn-tun-down ha-switch ha-hb-failure ips-signature ips-anomaly av-virus av-oversize av-pattern av-fragmented fm-if-change bgp-established bgp-backward-transition ha-member-up ha-member-down ent-conf-change av-conserve av-bypass av-oversize-passed av-oversize-blocked ips-pkg-update ips-fail-open faz-disconnect wc-ap-up wc-ap-down fswctl-session-up fswctl-session-down next end

[emnoc]

Do you have allowaccess and snmp enabled on that interface

e.g

config sys interface 

  edit wan1

      set allowaccess ssh https snmp

end

http://socpuppet.blogspot.com/2014/12/locking-down-fortigate-admin-access.html

Ken Felix

[alain]

yes it is "on"

[alain]

and snmp is allowed on the mgmt interface