SNMPv3 'Bad parse of ASN.1 type' Error with Schneider Machine Expert PLC

[AdriGallego14]

Hello everyone,

I'm facing a challenging issue while trying to monitor a Schneider Electric Machine Expert PLC using SNMPv3, and I'm hoping to get some help from the community.

The Problem

I can successfully poll the PLC using SNMPv1 and SNMPv2 from my Zabbix server. However, when I try to use SNMPv3 (with authNoPriv or authPriv security levels), Zabbix fails with the following error:

cannot read from session: Bad parse of ASN.1 type

This error suggests that Zabbix's backend is receiving a malformed response packet from the PLC's SNMP agent.

---

What Works vs. What Fails

Here is a summary of my tests so far:

• WORKS ✅
  • PLC polled via a generic MIB Browser tool using SNMPv1, v2, and even v3 noAuthNoPriv.
  • PLC polled via Zabbix using SNMPv1 and v2.
• FAILS ❌
  • PLC polled via Zabbix using SNMPv3 (authNoPriv or authPriv).
  • Using snmpwalk from the Zabbix server's command line with v3 auth parameters results in the same "Bad parse" error.

This leads me to believe that the PLC's SNMPv3 implementation might have a slight deviation from the standard that a flexible tool like MIB Browser tolerates, but that Zabbix's stricter SNMP library rejects.

---

[B]My Request: A Sample SNMPv3 Response Capture

[cyber]

This leads me to believe that the PLC's SNMPv3 implementation might have a slight deviation from the standard that a flexible tool like MIB Browser tolerates, but that Zabbix's stricter SNMP library rejects.

you cannot say that... you did not test same situations (MIB browser was tested with NoAuthNoPriv, but zabbix with AuthPriv or AuthNoPriv). And lets leave v1 and v2 alone, those work anyway...

Make sure your encryption is set same on both sides.. IF one side says SHA, then do not set other to SHA256, but SHA1 etc.. Try with MD5 also, might be some crappy implementation, not capable of better methods...

But .. tcpdump, wireshark, decrypt the comms, spend hours understanding the snmp v3 protocol etc.. Good luck..

[AdriGallego14]

Hi, I tried with NoAuthNoPriv in Zabbix and MIB browser, but yeah I guess I'll have to make some deep research about the snmp v3 protocol. Thanks for replying though.

[jtnfoley]

One thing I've done to understand industrial protocols is to check the opensource world for not-directly-related projects. SOMEBODY has made an effort to unpack Schneider ASN1 to SNMP structures, their efforts and sourcecode may lead to a better understanding ASN.1:

https://github.com/schneider-electric/asn1ate

Also, making google searches more generic led me to a lot more public info...
Googling for 'Schneider PLC "ASN.1"' get potentially useful hits where 'Schneider Electric Machine Expert PLC "Bad parse of ASN.1"' only returned this thread!

Sorry I can't be more help. I'm an old AB guy and have virtually no experience with Schneider (and absolutely no SNMP experience in PLCs in general.)

[AdriGallego14]

Hi, the problem was that Zabbix was expecting the username to be missing in the discovery response, whereas MibBrowser expected it to be 'initial'. I had originally configured the response for MibBrowser, which is why Zabbix couldn't handle it. However, as soon as I set the username parameter to null, it started working.