FortiOS v6.4.3 build1778 - problem with SNMPv3

[7rebe83]

Hello,

I have problem with configuration SNMPv3 on my virtual firewall.

I made it with this tutorial

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/62595/snmp

In systems logs ( events) I have this information.

VersionSNMP_v3MessageMessage authentication or checking failed (USM authentication failure).

I have checked pass and user login many times.

7Rebe83

[emnoc]

Did you check security parameters? If you want to do noAuthnoPriv for 1st stage testing and elimination that might be helpful but you have some type of authentication issue.

Ken Felix

[7rebe83]

Yes, I checked snmpv2 and worked well.

Do you have some additional tips :)

Rebe83

[emnoc]

Again , did you read what I posted earlier ?

If you want to do noAuthnoPriv for 1st stage testing and elimination

Your problem is 100% authentication related. You have to test and eliminate that. Setup a basic snmp users with no authentication or priv and test. Doe sit work ? If yes? Add on auth and retest if it does not work, perform the corrective action and proceed.

e.g 

config system snmp user edit "adminkfelix" set status enable set trap-status enable  set queries enable

# fo a 1st stage test  set security-level no-auth-no-priv next end

And then do a simple walk.

secenginfobankgrupo@socpuppets:~$ snmpwalk -v 3 -u adminkfelix  192.168.199.12     .1.3.6.1.2.1.47.1.2.1.1.2.1 iso.3.6.1.2.1.47.1.2.1.1.2.1 = STRING: "Fortinet Firewall FortiGate-100E v6.4.4,build1803,201209 (GA)"

If you do that and it works, than add in   auth-no-priv  and then auth-priv . Ensure your using the correct type

e.g

secenginfobankgrupo@socpuppets:~$ snmpwalk -v 3 -u adminkfelix -l authNoPriv -a SHA -A test1234567890 1 92.168.199.12  .1.3.6.1.2.1.47.1.2.1.1.2.1 iso.3.6.1.2.1.47.1.2.1.1.2.1 = STRING: "Fortinet Firewall FortiGate-100E v6.4.4,build1803,201209 (GA)"

for diagnostics fortiOS

diag debug reset 

diag debug enable

diag debug application snmpd -1

if you see " (USM authentication failure)" in the diagnostic again that means something wrong with authentication.

If you see  (unknown user name), than that's a clue your user is incorrect. But since you have USM issues ( from your earlier post)  your aes/3des or md5/sha is incorrect for that user. So the simplest means is to correct it or go thru the process of elimination.

Also be advise some snmp-NMS do not support MD5 so ensure the snmp-prober is correct or use snmp-utilility pkg in  a unix or linux systems. And some clients are des only so , upgrade that system. You should be using AES imho and SHA if possible.

Ken Felix