cannot query snmp

[alain]

Hi,

we have a fortigate HA pair 5.6.6 = FG200E-5.6.6-FW-build1630-180913

We would like to poll snmp by the mgmt interface 172.16.11.135 from 172.16.1.104.

Ping is ok

snmp is enable on the mgmt interface

host ip is defined

but snmp v1,v2 or even does not work at all.

Here is the debug log :

snmpd: request 1(root)/4/172.16.1.104 == comm 1/0/172.16.1.104/255.255.255.255 snmpd: matched community "public" snmpd: get-next: ifXEntry.1 -> () -> 0 snmpd: </msg> 0

snmpd: <msg> 44 bytes 172.16.1.104:7423 -> 172.16.11.135/172.16.11.135:161 (itf 4.4) snmpd: checking if community "public" is valid snmpd: checking against community "public" snmpd: request 1(root)/4/172.16.1.104 == comm 1/0/172.16.1.104/255.255.255.255 snmpd: matched community "public" snmpd: get-next: ifXEntry.1 -> () -> 0 snmpd: </msg> 0

snmpd: <msg> 44 bytes 172.16.1.104:7423 -> 172.16.11.135/172.16.11.135:161 (itf 4.4) snmpd: checking if community "public" is valid snmpd: checking against community "public" snmpd: request 1(root)/4/172.16.1.104 == comm 1/0/172.16.1.104/255.255.255.255 snmpd: matched community "public" snmpd: get-next: ifXEntry.1 -> () -> 0 snmpd: </msg> 0

[alain]

Hi,

there is no snmpd process listed with the "top" command...

Run Time: 55 days, 15 hours and 48 minutes 0U, 0N, 0S, 100I, 0WA, 0HI, 0SI, 0ST; 3963T, 3318F src-vis 169 S 0.1 1.0 insmod 111 S 0.1 0.0 miglogd 209 S 0.0 1.8 miglogd 144 S 0.0 0.9 pyfcgid 19264 S 0.0 0.7 cmdbsvr 126 S 0.0 0.7 forticron 154 S 0.0 0.7 httpsd 16721 S 0.0 0.6 httpsd 11002 S 0.0 0.6 sslvpnd 159 S 0.0 0.6 pyfcgid 19267 S 0.0 0.5 pyfcgid 19266 S 0.0 0.5 pyfcgid 19265 S 0.0 0.5 cw_acd 179 S 0.0 0.5 httpsd 147 S 0.0 0.5 hasync 166 S < 0.0 0.4 initXXXXXXXXXXX 1 S 0.0 0.3 updated 362 S 0.0 0.3 ipshelper 193 S < 0.0 0.3 httpsd 210 S 0.0 0.3

How can I start snmpd or Do i miss something ?

[smari]

If you are polling each HA cluster member directly ( I assume you have a individual ip on each management interface ) . 

You need to enable ha-direct

config system snmp communityedit 1set name Communityconfig hostsedit 1set ha-direct enableset ip 10.11.101.20endend If you have only one deticated management for the cluster you need to enable the ha-direct in the ha config ( If i remember correctly) : config system haset ha-direct enableend 

[smari]

By default the HA reserved management interface does not respond to management services

[alain]

Any comment ?

[alain]

UPgrade from 5.6.6 to 5.6.11 does not solve this problem.

I finally use another interface than the mgmt interface :  a LAN Interface, SNMP is now working.

I would appreciate to understand why a mgmt interface cannot be used for SNMP queries....

[boneyard]

alain did you see the reply from smari ?