Fortinet Firewalls - SNMNPv3 not working via Zabbix

[bradturnbough]

Zabbix Server 6.2 (yes, I know its unsupported now... I'm waiting on 7.0 to release. Dont harass me...)

I can query a Fortinet firewall and get data using SNMPv3, but with no auth and no priv:

root@server01:/usr/local/sbin# snmpwalk -v3 -u SNMPCOMMv3 -l noAuthNoPriv firewall01 sysUptime
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (732127511) 84 days, 17:41:15.1

I can also get SNMPv3 data when using auth, but no priv (MD5):

root@server01:/usr/local/sbin# snmpwalk -v3 -u SNMPCOMMv3 -l AuthNoPriv -a md5 -A test12345 firewall01 sysUptime
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (731296340) 84 days, 15:22:43.40

I can also get SNMPv3 data when using auth but no priv (SHA256):

root@server01:/usr/local/sbin# snmpwalk -v3 -u SNMPCOMMv3 -l AuthNoPriv -a sha256 -A test12345 firewall01 sysUptime
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (731300724) 84 days, 15:23:27.24

In Zabbix.....

noAuthNoPriv works just fine via Zabbix.

AuthNoPriv (md5) does NOT work via Zabbix.

AuthNoPriv (SHA256) via Zabbix also does NOT work.

I'm entering in the proper user and the proper password, that part hasn't changed one bit from test to test. I also know the username and password is correct since I can perform these tests via snmpwalk / cli.

Any ideas / pointers?

[bradturnbough]

Interesting finding...

If a fortinet firewall is configured for no auth and no priv for some time and is working....

And then you decide to change that host over to use authNoPriv, you first make the changes on teh firewall (sha256) and an appropriate password.

Then you head over to the host in Zabbix and update its settings... again... authNoPriv, SHA256 and the proper password.

Zabbix will not collect data from the device unless..... you restart the zabbix-server on the host.

[cyber]

snmp credential changes requires either server restart or snmp_cache_reload.. I don't remember the issue, why it does not pick that up on the fly...