Problems with SNMPv3 requests

[papanig]

Hello zabbix-forum,

we wanted to get a SNMPv3 discovery to work, but we are facing some issues right now.
At the moment we are thinking that there are some problems occuring during the authorization & encryption part.
We tested trying to use SNMPv2 to discover our MikroTik-routers which seems to work just fine but with SNMPv3 we get disconnects every 20 minutes and thats if the discovery actually works.


Few examples for output:

 16946:20211111:092638.258 getting SNMP values failed: Timeout while connecting to "XXXXXXX.13.1:161".

16938:20211111:093650.774 discovery: item [1.3.6.1.2.1.1.5.0] error: Timeout while connecting to "XXXXXXX.26.1:161".

We tried to get the values manually by using snmpwalk from the same machine.

Entering:

snmpwalk -v3 -l authPriv -u "XXXXXXX" -a MD5 -A "XXXXXXX" -x des -X "XXXXXXX" XXXXXXX.26.1 1.3.6.1.2.1.1.5.0

Results in:

iso.3.6.1.2.1.1.5.0 = STRING: "XXXXXXXXX.local"

Some Data:

Relevant server config settings:

StartPollers=25
StartPollersUnreachable=5
StartPingers=15
StartDiscoverers=15
CacheSize=32M
Timeout=15

Relevant Proxy config settings:

StartPollers=1
StartPollersUnreachable=5
StartPingers=5
StartDiscoverers=5
CacheSize=32M
Timeout=15

:

 16938:20211111:095422.020 discovery: item [1.3.6.1.2.1.1.5.0] error: Cannot connect to "XXXXXXX.61.1:161": Timeout.
 16938:20211111:095452.049 getting SNMP values failed: Cannot connect to "XXXXXXX.62.1:161": Timeout.
 16938:20211111:095452.049 discovery: item [1.3.6.1.2.1.1.5.0] error: Cannot connect to "XXXXXXX.62.1:161": Timeout.
 16938:20211111:095522.062 getting SNMP values failed: Cannot connect to "XXXXXXX.63.1:161": Timeout.
 16938:20211111:095522.062 discovery: item [1.3.6.1.2.1.1.5.0] error: Cannot connect to "XXXXXXX.63.1:161": Timeout.
 16938:20211111:095552.091 getting SNMP values failed: Cannot connect to "XXXXXXX.64.1:161": Timeout.
 16938:20211111:095552.091 discovery: item [1.3.6.1.2.1.1.5.0] error: Cannot connect to "XXXXXXX.64.1:161": Timeout.
 16938:20211111:095622.119 getting SNMP values failed: Cannot connect to "XXXXXXX.65.1:161": Timeout.
 16938:20211111:095622.119 discovery: item [1.3.6.1.2.1.1.5.0] error: Cannot connect to "XXXXXXX.65.1:161": Timeout.
 16938:20211111:095652.148 getting SNMP values failed: Cannot connect to "XXXXXXX.66.1:161": Timeout.
 16938:20211111:095652.148 discovery: item [1.3.6.1.2.1.1.5.0] error: Cannot connect to "XXXXXXX.66.1:161": Timeout.
 16938:20211111:095722.181 getting SNMP values failed: Cannot connect to "XXXXXXX.67.1:161": Timeout.
 16938:20211111:095722.181 discovery: item [1.3.6.1.2.1.1.5.0] error: Cannot connect to "XXXXXXX.67.1:161": Timeout.
 16938:20211111:095752.210 getting SNMP values failed: Cannot connect to "XXXXXXX.68.1:161": Timeout.
 16938:20211111:095752.210 discovery: item [1.3.6.1.2.1.1.5.0] error: Cannot connect to "XXXXXXX.68.1:161": Timeout.
 16938:20211111:095822.238 getting SNMP values failed: Cannot connect to "XXXXXXX.69.1:161": Timeout.
 16938:20211111:095822.238 discovery: item [1.3.6.1.2.1.1.5.0] error: Cannot connect to "XXXXXXX.69.1:161": Timeout.
 16938:20211111:095852.311 getting SNMP values failed: Cannot connect to "XXXXXXX.70.1:161": Timeout.
 16938:20211111:095852.311 discovery: item [1.3.6.1.2.1.1.5.0] error: Cannot connect to "XXXXXXX.70.1:161": Timeout.
 16938:20211111:095922.340 getting SNMP values failed: Cannot connect to "XXXXXXX.71.1:161": Timeout.
 16938:20211111:095922.340 discovery: item [1.3.6.1.2.1.1.5.0] error: Cannot connect to "XXXXXXX.71.1:161": Timeout.
 16938:20211111:095952.381 getting SNMP values failed: Cannot connect to "XXXXXXX.72.1:161": Timeout.
 16938:20211111:095952.381 discovery: item [1.3.6.1.2.1.1.5.0] error: Cannot connect to "XXXXXXX.72.1:161": Timeout.

Any suggestions we could try?

Kind regards

[Braian Antoniolli]

I`m facing the same problem with Mikrotik devices.
SNMP queries always works on terminal, but have intermittent timeouts (using the same configuration) on the web interface, causing all hosts getting unavailable.


I`m using Zabbix 5.0.17 LTS, no proxy. Passwords don`t have special symbols (because it broke snmp command)

[Braian Antoniolli]

I think i have solved it.
After some searches, I've found that queries over SNMPv3 requires unique engine IDs.

Mikrotik's O.S. don't have an automatically generated engine ID, it is an empty string by default, according to documentation. See more at https://wiki.mikrotik.com/wiki/Manua...ral_Properties