OPNsense SNMP Template

[stevefxp]

Hello all,

I am using the SNMP template for monitoring my OPNsense firewall. I have followed the instructions in the template, and am getting good information but the attached screenshot shows some lines that are showing No Such Object available on this agent at this OID. Am I missing something in the config?

https://ibb.co/gwhhMhv

Thanks,
Steve

[Vermizz]

Hello,
What version of OPNsense are you using?
What template do you use for monitoring OPNsense?
If you using this template: https://www.zabbix.com/integrations/opnsense it is tested for version: OPNsense 22.1.9. If you are using a newer version of OPNsense it is possible that the OID for given items has changed.
You can test OID for "OPNsense: Packets dropped due to memory limitation' using this command from zabbix server:
snmpwalk -v 2c -c public [IPyouOPNsense] 1.3.6.1.4.1.12325.1.200.1.2.6.0
or for SNMP v1:
snmpwalk -v1 -c public [IPyouOPNsense] 1.3.6.1.4.1.12325.1.200.1.2.6.0

[stevefxp]

Yes I am testing it on 23.7.8. I will run the command and see what comes back. Does it come down to updating the template with new OID info? I would like to work with the owner of the template, to update this.

[stevefxp]

Ok looks like there is an error: iso.3.6.1.4.1.12325.1.200.1.2.6.0 = No Such Object available on this agent at this OID

It looks like this is the OID on 23.7.8: 3.6.1.4.1.12325.1.200.1.8.2.1.2. This is showing on the following error msgs in Zabbix Latest Data: Cannot find index of "em0" in ".1.3.6.1.4.1.12325.1.200.1.8.2.1.2". I am also getting a bunch of No Such Object available on this agent at this OID errors and a Cannot evaluate function: item "/opnsense.nsc.home/opnsense.state.table.count" is not supported at "last(//opnsense.state.table.count) * 100 / last(//opnsense.state.table.limit)". I am hoping I can solve these.

[Vermizz]

Hi, have you followed the instructions in the template and are you using bsnmpd?

https://www.zabbix.com/integrations/opnsense

Setup

1. Enable bsnmpd daemon by creating new config file "/etc/rc.conf.d/bsnmpd" with the following content:
bsnmpd_enable="YES"
2.Uncomment the following lines in "/etc/snmpd.config" file to enable required SNMP modules:
begemotSnmpdModulePath."hostres" = "/usr/lib/snmp_hostres.so"
begemotSnmpdModulePath."pf" = "/usr/lib/snmp_pf.so"
3.Start bsnmpd daemon with the following command:
/etc/rc.d/bsnmpd start
4.Setup a firewall rule to get access from Zabbix proxy or Zabbix server by SNMP (https://docs.opnsense.org/manual/firewall.html).
5.Link the template to a host.

Do you have the latest version of the template?

Go to:
Configuration / Templates / OPNSENSE SNMP / MACROS
What value do you have for: $NET.IF.IFADMINSTATUS.MATCHES

[stevefxp]

I have followed all the instructions, with the exception of the firewall rule. It was my understanding that since Zabbix is sitting behind the firewall, on a LAN segment, that my default open rule would take effect.

^.* is the value shown.

Another funny problem...I originally had the SNMP plugin installed on the firewall. It seems it has issues with bsnmpd, so I removed it. Now Zabbix is telling me I have no SNMP collection. I think I am going to delete the host all together and start from scratch. Do you know if the SNMP plugin does not play well with bsnmpd?

[Vermizz]

Unfortunately, I haven't used OPNsensei for a long time and I have no way to check this problem in production. If I find time, I will create a lab for the test.
Check out this post on the OPNsense forum, it looks similar, maybe this will help: https://forum.opnsense.org/index.php?topic=33481.0

[stevefxp]

Unfortunately, I haven't used OPNsensei for a long time and I have no way to check this problem in production. If I find time, I will create a lab for the test.
Check out this post on the OPNsense forum, it looks similar, maybe this will help: https://forum.opnsense.org/index.php?topic=33481.0

Thanks...I am continuing to work through it. Since I have OPNsense and Zabbix implemented I am happy to be your hands to see if there is something to be updated. I would think a SNMPWALK of my OPNsense server would be a good start?

[s841]

Another funny problem...I originally had the SNMP plugin installed on the firewall. It seems it has issues with bsnmpd, so I removed it. Now Zabbix is telling me I have no SNMP collection. I think I am going to delete the host all together and start from scratch. Do you know if the SNMP plugin does not play well with bsnmpd?

Just commenting for anyone else who has this same issue since I was able to find a resolution in my case.

I was having the same issue when trying to use the OPNsense by SNMP template. I also had a lot of items that were showing the "No Such Object" error and similar errors, but some items did work. I found my issue was that I had the os-net-snmp package installed on my firewall. I had already followed the template instructions for setup at https://www.zabbix.com/integrations/...#opnsense_snmp.

I found that running

/etc/rc.d/bsnmpd status

showed that the service was not running. Further inspection via netstat showed that snmpd was already bound to port 161/udp. I guess that uninstalling the os-net-snmp package alone isn't enough, so I also had to run

service snmpd stop

to stop the service and then the port was free. After stopping the old snmpd service, I was able to start bsnmpd successfully and my host was populating all items without any issues in Zabbix.

One note was that I did have to ensure my SNMP community. Apparently, it's "public" by default, and is set (and configurable) in the /etc/snmpd.conf file on OPNsense at around line 24. The line that looks like so:

# Change this!
read := "public"

Be sure to restart the service if you change it while it's running.

OPNsense version: 24.1.9

[Keulix]

I just upgraded to opnsense 24.7.1 (from 24.1...) through the GUI update process, which ran smoothly - and the new dashboard looks so nice.

However, before that upgrade, the connection from Zabbix 7.0.1(server) was fine using the template "OPNsense by SNMP". Since the update some values were no more or reported wrong in Zabbix. E.g., DNS, DHCP services are now reported "not running" although the services do run fine. The graphs for the item values show pretty exactly the time of the reboot after the update to drop to the wrong values. The affected triggers of course run wild now.

bsnmp and the likes seem to run fine: bsnmp status = running, service snmpd status = not running. At least snmpwalk from zabbix server to opnsense brings back (lots of) reasonable values (I haven't checked yet in detail).

How can I check where things start getting wrong? Are some objects mapped differently (or missing)? Did some OIDs change? I could start with one of the now odd values (e.g. DHCP), if only knew where to start with the "investigation". Or does anybody know if we have to wait for some more updates yet to come?

[t00m1G]

Hey Keulix ,

To check OID values you can use tool like SNMPwalk - with that tool you can verify OID values, and then if needed you can do changes of those values in template you mentioned.