Can't use SNMPv3 on Meraki AP on FortiNAC

[motorbass]

Hi

We're currently trying FortiNAC v7.2.5.0101, everything runs smoothly for most of our devices except for Meraki AP.

We follow this guide for configuring/adding the AP https://docs.fortinet.com/document/fortinac-f/7.2.0/network-device-modeling/785561/cisco-meraki-ms-s...

Indeed, even though SNMPv3 is enabled on our Meraki oraganization and so AP ( snmpwalk -v3 is ok) FortiNAC always throws an error while trying to add it using S/N as UserName and API Key as Password as you can see below:

From a firewall perspective we got not deny or any filtering, proof is we can add the same AP using SNMPv2c for instance.

From a FortiNAC perspective, there's no such log or information that may helps to troubleshoot this.

Any of you guys succeed to use SNMPv3 between FortiNAC and Meraki ?

Thanks a lot for your help & advices

FortiNAC  

[ozkanaltas]

Hello @motorbass ,

I think it's related to SNMP_Protocol. Can you change SNMP_Protocol with SNMPv3 AuthNoPriv.

Or you need to fill the privacy password area with the password. 

[motorbass]

Hi

Just gave a try and same error.

UserName is still S/N and Authentication Password is my API Key

[ozkanaltas]

Hi @motorbass , 

Firstly you need to add a Meraki device with snmp credentials. You can configure this credential on a Meraki device.

SNMP

Configure SNMP access to allow for FortiNAC device discovery. Under the Network-wide > General > SNMP section, allow either v1/v2 or v3 access

After adding the Meraki device on FortiNAC, you can configure the username and API key in the model configuration menu on FortiNac

But first, you need to add the Meraki device to FortiNac with SNMP credentials. 

I found one document about how to configure SNMPv3 credentials on the Meraki MS switch. You can review this document.

https://support.auvik.com/hc/en-us/articles/204356740-How-to-enable-SNMP-on-Meraki-devices

[motorbass]

Hi

Sorry but i don't understand this answer, this is what I did and what I explain in my original post. I'm currently trying to add my device with SNMP credentials + as mentionned SNMPv3 is already properly configured on Meraki as I can reach it through snmpwalk -v3..

[ozkanaltas]

Hello @motorbass ,

Can you share the full command of the snmp walk you tested? You can mask credentials. I just want to see the parameters in your command. 

[motorbass]

Sure here it is

```

snmpwalk -v3 -l authPriv -u "XXXXX" -a SHA -A "YYYY" -x des -X "YYYY" 10.10.10.10

```

[ozkanaltas]

Hello @motorbass ,

Can you fill the FortiNAC snmp area with these information? 

Username : -u "XXXXX"

Authentication Protocol : -a SHA

Authentication Password : -A "YYYY"

Privacy Protocol : -x des

Privacy Password : -X "YYYY" 

[motorbass]

Great idea,

Just tried, same error unfortunately...

I think we're close to it

[ndumaj]

Hello,
According to the Error, FNAC sends SNMPv3 requests to get sysobjectID from the device but the switch does not respond with the appropriate parameters and FNAC states -> "Unable to contact"
It looks to be a misconfiguration of SNMPv3.
Article:
https://community.fortinet.com/t5/FortiNAC/Technical-Tip-Troubleshooting-SNMP-communication-issues/t...

Check on Meraki  if there is any indication why it is refusing the FNAC request.

BR