SNMPv3 do not work in zabbix

[akbar415]

Solved

If I run snmpwalk on the same machine of zabbix server I can collect data with snmpv3

snmpwalk -v3 -u Usnmp -l AuthNoPriv -a MD5 -A 'AuthPass' 10.x.x.x .1.3.6.1.2.1.1.3.0
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (61650508) 7 days, 3:15:05.08

But in Zabbix Server I can't.

Zabbix do not give me data, queue always empty for snmpv3 agent, error message in front end no even error message in the log.



My zabbix config:

Type: SNMPv3 agent
Key: SysUptime
Host interface: 10.x.x.x:161
SNMP OID: .1.3.6.1.2.1.1.3.0
Security name: {$SNMP_SECNAME}
Security level: authNoPriv
Authentication protocol: MD5
Authentication passphrase: {$SNMP_AUTH}



Zabbix 3.0

The problem was in the firewall cluster.

When zabbix sends the snmp request through the firewall cluster and, for example, hits firewall node A, the response is sometimes received by firewall node b. Since firewall node b doesn't know who sent the request, it simply drops it.

[qix]

If you run into this issue, please make sure snmpEngineIDs for your devices are unique. snmptools like snmpwalk do not track these, however Zabbix does use it to differentiate between packets from different devices. If the snmpEngineIDs are not unique, this can create unforeseen issues.

Also, you could be running into problems with devices not upholding RFC regarding snmpEngineTime during communications with Zabbix. Restarting Zabbix server or the device SNMP engine usually resolves this issue.

see https://support.zabbix.com/browse/ZBX-2152 for more background info.

[sfl]

Hi all,

I went to the bottom of this question and found that (from my perspective) AES encryption is the problem. If I configure DES/SHA on device and on ZBX no more unsupported item !

@qix yes snmpengineid are all different
Hope this help,
Sfl

[cmekcik]

having same issue with snmp v3 with des/sha encoding. device randomly shows timeout 161. i have more then 50 devices same configuration and same software version. some of them working all the time, some temporary. and i can always get snmp data manually from snmpwalk. zabbix 3.2.10 and the same problem was on 2.4. snmp bulk requests on hosts enabled

[dimir]

What is the TIMEOUT value in server (proxy) config?

[cmekcik]

What is the TIMEOUT value in server (proxy) config?

default (3)

[dimir]

Perhaps 3 seconds is not enough for bulk requests, if it's possible try increasing it.

[colohost]

Just wanted to say thanks; encountered same issue of items randomly going to invalid with the "Authentication failure (incorrect password, community or key)" error; we're using SNMPv3 and it ended up being the Timeout value.

[Mechanix]

If you run into this issue, please make sure snmpEngineIDs for your devices are unique. snmptools like snmpwalk do not track these, however Zabbix does use it to differentiate between packets from different devices. If the snmpEngineIDs are not unique, this can create unforeseen issues.

Also, you could be running into problems with devices not upholding RFC regarding snmpEngineTime during communications with Zabbix. Restarting Zabbix server or the device SNMP engine usually resolves this issue.

see https://support.zabbix.com/browse/ZBX-2152 for more background info.

I had exactly the same issue with a Juniper SRX cluster. Polling the cluster with its vip IP didn't work, which led in disabling the device in Zabbix. The solution was to configure each node IPs in Zabbix

[kloczek]

Timeout issues have nothing to do with zabbix.
There a re two possible causes:
- to weak CPU in embedded system to handle SNMPv3 encryption (may help switch to SNMPv2)
- bugs in SNMP agent running on monitored device (if you will still see timeouts after switching to SNMPv2 just open support case for your device)

[David_Yang]

same pablem, I can get the information from command snmpwalk -v 3 -u ****-l authPriv -a sha -A *****-x aes -X ****10.*.*.* ".1.3.6.1.2.1", but zabbix system report the "Cannot connect to "10.*.*.*:161": No securityName specified. "