SNMP v3 Configuration Loss on ISE 3.1

[Karam Alshaltan]

A customer encountered a loss of SNMP v3 configuration on ISE 3.1. Despite SNMP being enabled, the authentication details appear to be absent. Do you have any knowledge of a bug associated with this particular issue?

[Greg Gibbs]

Not much to go on here in regards to symptoms or other factors. Maybe the users were using invalid characters or were not reconfigured after an upgrade to 3.1 as per the Release Notes?

You can search the same release notes for any SNMP related bugs that have been fixed in released patches.

You can search for known bugs that may not have been fixed yet in the Bug Search Tool. If this is a recurring issue and can be replicated with the latest patch applied, you might need to open a TAC case to investigate further.

[adamscottmaster2013]

This is an issue with ISE 3.2 patch-3 and lower.  There is an actual bug ID on it.  Cisco released patch-4 to fix this issue.  Can't comment on 3.1 because I am also running ISE 3.1 patch-7 with no snmpv3 issue so far with some weird long snmp password and privilege strings

[Arne Bier]

yeah  - as @adamscottmaster2013  said, this was discussed in the Wireless TAC Times discussion in August 2023 - I don't keep up with all of them but the PPT and recordings are online.

• CSCwe95624 - ISE 3.2 SNMP is not working after node restart
• Fixed in 3.2 patch 4
• Workaround is to remove and reapply SNMP configuration on CLI post reboot

I can confirm that this bug is certainly fixed with my customers running ISE 3.2p4 and SNMPv3 

[Yordan1]

hi 

i am facing the issue mit 3.2p5 / snmpv3,, the workaround didnt help

regards

[Minnesotakid]

@Arne Bier I believe I'm still hitting this on my newly upgraded ISE 3.2 p4 system. I patched from 3.1 p7 to 3.2 then patched manually after the upgrade was successful. Commenting in case others are also hitting the same issue. I've raised a TAC case for confirmation. All 5 of my servers needed to have snmpv3 settings removed and re-added to resolve.

[Arne Bier · Accepted solution]

@Minnesotakid - oh boy!  As always, we roll the dice and see what happens. I get quite upset when I think about something as simple as SNMP not working in a flagship enterprise product like ISE. I think opening a TAC case is the course of action - it will cause more work for everyone (you and Cisco) and hopefully some good will come of it. And maybe one day the BU will learn about software version control and software quality assurance. Then we can all sleep better and do more productive things in our lives.

[DL-NZInfrastructure-Networks]

I encounted this problem after updating from ISE 3.1 patch 5 to ISE 3.1 patch 9.

After the update, all four of our ISE nodes failed an snmpv3 poll from both of our snmp servers).

I tried re-entering the snmp username and the command went in without error. However doing a "sh snmp user" gave no output (The snmp user was gone - never to return again).

I have logged a call with Cisco TAC.

[oumodom]

Hi @DL-NZInfrastructure-Networks 

Great to know you are using v3.1 P9 and SNMPv3 issue with Monitoring, while we have the same and hope it fix by P9.
Does the case have been resolved? What is the solution from TAC? 

Really appreciate if you could share the experience. 
Thank you,  

[DL-NZInfrastructure-Networks · Accepted solution]

Hi There,

The case was resolved by removing, and reapplying, the whole SNMP configuration on CLI. I'm hoping that was a permanent fix and it does not re-appear after a reboot. However, I'll be ready if it does.

[oumodom · Accepted solution]

Thank @DL-NZInfrastructure-Networks