cannot query snmp

[alain]

Hi,

we have a fortigate HA pair 5.6.6 = FG200E-5.6.6-FW-build1630-180913

We would like to poll snmp by the mgmt interface 172.16.11.135 from 172.16.1.104.

Ping is ok

snmp is enable on the mgmt interface

host ip is defined

but snmp v1,v2 or even does not work at all.

Here is the debug log :

snmpd: request 1(root)/4/172.16.1.104 == comm 1/0/172.16.1.104/255.255.255.255 snmpd: matched community "public" snmpd: get-next: ifXEntry.1 -> () -> 0 snmpd: </msg> 0

snmpd: <msg> 44 bytes 172.16.1.104:7423 -> 172.16.11.135/172.16.11.135:161 (itf 4.4) snmpd: checking if community "public" is valid snmpd: checking against community "public" snmpd: request 1(root)/4/172.16.1.104 == comm 1/0/172.16.1.104/255.255.255.255 snmpd: matched community "public" snmpd: get-next: ifXEntry.1 -> () -> 0 snmpd: </msg> 0

snmpd: <msg> 44 bytes 172.16.1.104:7423 -> 172.16.11.135/172.16.11.135:161 (itf 4.4) snmpd: checking if community "public" is valid snmpd: checking against community "public" snmpd: request 1(root)/4/172.16.1.104 == comm 1/0/172.16.1.104/255.255.255.255 snmpd: matched community "public" snmpd: get-next: ifXEntry.1 -> () -> 0 snmpd: </msg> 0

[alain]

is it supported to query snmp on the Mgmt interface ?

[Dave_Hall]

Supposedly.  Though make sure the Trusted Hosts is set accordingly.

[alain]

 

sometimes strangely, community names are empty using the web interface :

the poller is 172.16.1.104

[alain]

any idea ?

[emnoc]

Dump the cfg from cli

show full sys snmp community

show full sys snmp sysinfo

Here's a screenshot of a test 

FWF50E3U1700XXXXX #   show full-configuration  sys snmp  communityconfig system snmp community    edit 1        set name "mycommunity"        set status enable        config hosts            edit 1                set source-ip 0.0.0.0                set ip 0.0.0.0 0.0.0.0                set ha-direct disable                set host-type any            next        end        set query-v1-status enable        set query-v1-port 161        set query-v2c-status enable        set query-v2c-port 161        set trap-v1-status enable        set trap-v1-lport 162        set trap-v1-rport 162        set trap-v2c-status enable        set trap-v2c-lport 162        set trap-v2c-rport 162        set events cpu-high mem-low log-full intf-ip vpn-tun-up vpn-tun-down ha-switch ha-hb-failure ips-signature ips-anomaly av-virus av-oversize av-pattern av-fragmented fm-if-change bgp-established bgp-backward-transition ha-member-up ha-member-down ent-conf-change av-conserve av-bypass av-oversize-passed av-oversize-blocked ips-pkg-update ips-fail-open faz-disconnect wc-ap-up wc-ap-down fswctl-session-up fswctl-session-down load-balance-real-server-down per-cpu-high    nextend 

FWF50E3U170XXXXX # show full-configuration  sys snmp  sysinfo 

config system snmp sysinfo   

set status enable   

set engine-id ''   

set description "socpuppetsblogs"   

set contact-info ''   

set location "socpupps"   

set trap-high-cpu-threshold 80   

set trap-low-memory-threshold 80   

set trap-log-full-threshold 90end  

Ken Felix

[emnoc]

Note above is from v6.0

Ken Felix

[alain]

here are the results from cli :

FortiFW-1 # show full sys snmp community config system snmp community edit 1 set name "public" set status enable config hosts edit 1 set source-ip 0.0.0.0 set ip 172.16.1.104 255.255.255.255 set ha-direct disable set host-type any next edit 2 set source-ip 0.0.0.0 set ip 172.28.0.1 255.255.255.255 set ha-direct disable set host-type any next end set query-v1-status enable set query-v1-port 161 set query-v2c-status enable set query-v2c-port 161 set trap-v1-status enable set trap-v1-lport 162 set trap-v1-rport 162 set trap-v2c-status enable set trap-v2c-lport 162 set trap-v2c-rport 162 set events cpu-high mem-low log-full intf-ip vpn-tun-up vpn-tun-down ha-switch ha-hb-failure ips-signature ips-anomaly av-virus av-oversize av-pattern av-fragmented fm-if-change bgp-established bgp-backward-transition ha-member-up ha-member-down ent-conf-change av-conserve av-bypass av-oversize-passed av-oversize-blocked ips-pkg-update ips-fail-open power-supply-failure faz-disconnect wc-ap-up wc-ap-down fswctl-session-up fswctl-session-down load-balance-real-server-down per-cpu-high next end

FortiFW-1 # show full sys snmp sysinfo config system snmp sysinfo set status enable set engine-id '' set description "FW Fortinet" set contact-info '' set location "BTA - Salle informatique" set trap-high-cpu-threshold 80 set trap-low-memory-threshold 80 set trap-log-full-threshold 90 end

[alain]

Any comments on my config ?

Is there a way to restart "SNMP agent"  from cli ?

What do you think of just rebooting the box ?

[alain]

Any comments on my config ? Is there a way to restart "SNMP agent"  from cli ? What do you think of just rebooting the box ?

[emnoc]

If int4.4 is a mgmt interface and you have no local filters and the community is correct and allowaccess shows snmp allowed, it should work unless routing is bad to 172.16.1.104

Since ping is working, I would suspect routing is good. Are you sure the community has no whitespace or other issues?

You should not need to restart the host or snmp-agent but if you desire you could killed  HUP snmpd

diag sys kill HUP PID

e.g killing update pid based on top

Run Time:  226 days, 1 hours and 58 minutes0U, 0N, 0S, 100I, 0WA, 0HI, 0SI, 0ST; 2021T, 1618F       forticron      129      S       0.1     0.6          flcfgd      159      S       0.1     0.2         cmdbsvr      102      S       0.0     1.1         pyfcgid      123      S       0.0     1.1          cw_acd      153      S       0.0     0.8          httpsd      122      S       0.0     0.8         miglogd      120      S       0.0     0.8         pyfcgid      180      S       0.0     0.7         pyfcgid      178      S       0.0     0.7         pyfcgid      179      S       0.0     0.7         cw_wtpd      156      S       0.0     0.7          httpsd      188      S       0.0     0.6          httpsd      735      S       0.0     0.6           fgfmd      152      S       0.0     0.5          newcli     9136      S       0.0     0.5         miglogd      172      S       0.0     0.5 initXXXXXXXXXXX        1      S       0.0     0.4          httpsd      187      S       0.0     0.4         updated      136      S       0.0     0.4       ipshelper     9143      S <     0.0     0.3 SOMESTUPIDFGTFW # diag sys kill 9 136 To get the pid do a dump  SOMESTUPIDFGTFW # diag sys  process pidof snmpd137  So in the above case you will kill off pid#137 and ensure it restarts and grab a new pid SOMESTUPIDFGTFW # diag sys kill 9 137 SOMESTUPIDFGTFW # diag sys  process pidof snmpd9154 Your cfg looks good btw. Status are enabled, I doubt the services are running on that interface. I would try another interface for eliminatation with the same community. I seen dedicated mgmt interface do weird things some times. Also ensure trusted hosted are  not impacting any items. Ken Felix