SNMPv3 trap does not work after password change

[stanley783]

I am configuring SNMPv3 for traps and some device info using agent, using snmptrapd. I configured several hosts which are working, but have a problem with first host i was trying to configure/test/setup. (Cisco Switch 3750X)

First, i set simple password, which i wanted to change to more complex when everything would be working. After everything is working, file is filling, snmptrap history in zabbix fronted for latest data is growing, i changed pwd both on cisco and in snmptrapd.conf file which has:

#createUser zab-mon SHA easypwd1 AES easypwd2

createUser -e "0x80 00 00 09 XX XX XX XX XX" zab-mon SHA AES easypwd1 AES easypwd2

First time i created just as its in first line, then added other line with -e parameter later on (or was it the other way?). Anyway, after i changed both easy passwords to complex and commented out that first line in snmptrapd, also changed at SNMP agent Zabbix>config>host>SNMP agent, the file is not increasing, even tho i see, by using tcpdump, that traps are comming, also snmpget is working. On Cisco SW i tried to remove user, group, host and configure them again in same manner as its on other properly working switches, recreated host also on zabbix, but the issue still persists.

Is reason for this that one engineID is linked with old password and have to change it somehow, even when users are configured only by snmptrapd file? I use same user on every other device. I do not know if there is some table regarding this users by which i can change user password/secret but i see i can only change based on USER, but i have same user configured with different engineID (only in that file, did not create any user by commands on zabbix). Also to check snmp table for users, do i also have to configure my zabbix as some snmp member to get info calling it by snmpget OID for that user table? Thanks.

[NilsA]

Hi,
I've only tested snmptraps with Zabbix so I am by no means an expert on this topic. From what I have read, you don't need to give an engine id, neither does Zabbix need any information on the device.
It should work by simply adding a fallback snmptrap item on your Cisco Switch 3750X in Zabbix, then change the config to contain the new complicated password.

[stanley783]

Hi,

thanks for response, yes i will configure without engine ID for easier configuration, but the issue still persist tho.

Now as i changed configuration on switch to use new complicated password, on zabbix server i see via tcpdump that switch is sending traps, but zabbix is not adding them to that specific host under trap latest data, nor it is in trapfile, which is the issue. I tought there would be some DB of users created, but i was able only to find that some DB exists, not able to get into it or se users, configured probably trough snmptrapd.conf, but i do not know where the DB is and how to check users in it.

I also tried to configure new user, create him in snmptrapd.conf and configure him on switch, snmpget works fine, traps are received on server, but not updated as stated above.

Any ideas?
Reminder: i have issue only with this specific switch, latest data on other switches of same model are updated correctly.

[NilsA]

Have you changed the configs and restarted the services after for the new password?

[stanley783]

My snmptrapd.conf has now several users (with only SHA and AES passwords specified) and those users have log,execute rights, and yes restarted both zabbix-server and snmptrapd services.

For this purpose i also created new user for that specific switch, removed all snmp related configuration on SW, configured it again. Does not work. When i configure everything to first-time-like (old user with simple password), the traps are updated for the switch.

Any tip for debugging? In trapfile, the new testing user is not even mentioned, in syslog this switch is mentioned only with old user/password configuration (when it works) and following this tip: https://support.nagios.com/kb/article.php?id=88

Execute the following command:

systemctl edit snmptrapd.service


Paste the following into the new file:

[Service] ExecStart= ExecStart=/usr/sbin/snmptrapd -Ln -f -Lf /var/log/snmptrapd.log


Now restart the SNMPTRAPD service:

systemctl daemon-reload
systemctl restart snmptrapd.service

shows only very little of properly handled traps from other switches, so i do not know how to check how the problematic switch traps are handled. Any tip for debugging? Thanks.

[stanley783]

I somewhat figured the issue:

First time i configured snmptrapd.conf, for this switch i created user with SHA, AES passwords and also engineID, afterwards, i made configuration for user only with passwords thinking that this user with ANY engineID would be allowed to update trapfile but that was not the case. So the user is in DB paired with engineID i presume?

when i configured

createUser -e "0x80 00 00 09 XX XX XX XX XX" zab-montest SHA easypwd1 AES easypwd2  #its new user, old password

then that user is able to update the trapfile...

Seems i can not have same user configured twice -with and without engineID (which makes sense) but also once i used engineID, a i have to configure user WITH engineID for that host.

The question now is, where are these created users (created by snmptrapd.conf file) stored and how do i get there? As i would like to remove those with engineID related.Thanks.

EDIT: After checking some forums and guides, there is always stated, regarding SNMPv3, that using engineID is necesarry. This proved to be true for new switches i was configuring, as without it, fallback traps was not updated for those hosts.