SNMPv3 Traps and Informs not processing in Zabbix GUI

[GarrettCO]

So I'm at the end of my rope with SNMPv3 TRAPS. I can see using Wireshark SNMPv3 traffic coming into the Zabbix Server from the host but not traversing to GUI through snmptrapd.conf file per documentation. The template that I have configured is only performing ICMP ping, no SNMP poliing, and I added a snmptrap.fallback item because I just need to capture traps from the hosts.

Does Zabbix need to to establish SNMP availability by port 161 first in order to receive SNMP on 162? The network rule in place right now is 162 is wide open to CIDR 0.0.0.0

snmptrapd.conf

authUser log,execute,net vivasnmp
createUser -e 0x80001f8880fda30422965c046700000000 vivasnmp SHA xxxxxx AES xxxxxxxxx

PCAP image:

[ISiroshtan]

You showed username in snmptrad.conf but decided to cut it out in screenshot? Is there any point to it?

To answer your question: no, it does not need reachability on port 161 to process traps.

I fail to see the traphendler directive in snmptrapd.conf file, that is likely reason to issue. Please check documentation about setting up SNMP traps in Zabbix again.

In essence the flow of traps for Zabbix works like:
Device sends trap -> trap received by snmptrapd daemon -> snmptrapd passes trap to one of trap handlers (back when I worked with them we mostly used perl trap handler) -> trap handler logs this trap to special log file with special formatting -> Zabbix reads file regularly and saves data to corresponding host/items.
So after you configured trap handler you can send trap and verify that it's logged in file.
If it does not - something is wrong in snmptrapd/trap_handler in regard to log file.
If it does - you can verify Zabbix UI.
If it still not present here - verify that traphandler and zabbix server configured to use same log file and that snmp traps processing is enabled in Zabbix server config file.

[ISiroshtan]

You showed username in snmptrad.conf but decided to cut it out in screenshot? Is there any point to it?

To answer your question: no, it does not need reachability on port 161 to process traps.

I fail to see the traphendler directive in snmptrapd.conf file, that is likely reason to issue. Please check documentation about setting up SNMP traps in Zabbix again.

In essence the flow of traps for Zabbix works like:
Device sends trap -> trap received by snmptrapd daemon -> snmptrapd passes trap to one of trap handlers (back when I worked with them we mostly used perl trap handler) -> trap handler logs this trap to special log file with special formatting -> Zabbix reads file regularly and saves data to corresponding host/items.
So after you configured trap handler you can send trap and verify that it's logged in file.
If it does not - something is wrong in snmptrapd/trap_handler in regard to log file.
If it does - you can verify Zabbix UI.
If it still not present here - verify that traphandler and zabbix server configured to use same log file and that snmp traps processing is enabled in Zabbix server config file.

[cyber]

yep.. pure gold there...:P

also check if all your SHA/AES versions (or whatever those are) are correct... 128/192/256 etc... eventho most of network gear I have seen try to get away with as small as possible ...:P