SNMP Failed | SNMP & ACL Problem \ Question

[khnrjm]

Hello,

I am trying to configure SNMP access to NeDi on a Catalyst 9300 Switch. This is the current status:

Nedi:
Created the "nedimon" community string. (SNMP v2c)

C9300:
snmp-server community nedimon RO IPv4-RO-SNMP-LOCAL

Standard IP access list IPv4-RO-SNMP-LOCAL
10 permit 192.168.3.91
20 deny any log

...

This is the config part. In our switch, we have a few other ACLs too:

Standard IP access list IPv4-NTP-CLIENTS
10 permit X.X.X.X, wildcard bits 0.0.0.7 (37450 matches)
11 permit X.X.X.X, wildcard bits 0.0.0.15
12 permit X.X.X.X, wildcard bits 0.0.0.31
Standard IP access list IPv4-NTP-SERVER
10 permit X.X.X.X (293033 matches)
Standard IP access list IPv4-RO-SNMP-ACCESS
10 permit X.X.X.X, wildcard bits 0.0.0.15 (570214 matches)
20 permit X.X.X.X, wildcard bits 0.0.0.31 (2525698 matches)
30 permit X.X.X.X, wildcard bits 0.0.0.7 (615434 matches)
40 permit X.X.X.X, wildcard bits 0.0.0.15
50 permit X.X.X.X, wildcard bits 0.0.0.31 (30456294 matches)
60 permit X.X.X.X, wildcard bits 0.0.0.15
70 deny any log (1046 matches)
Standard IP access list IPv4-RO-SNMP-LOCAL
10 permit 192.168.3.91
20 deny any log

And if I run an SNMP discovery in Nedi, I've got this error: SNMP Failed

And I also saw in C9300 logs: %SEC-6-IPACCESSLOGS: list IPv4-RO-SNMP-ACCESS denied 192.168.3.91 packets

This is the ACL above my new ACL. Of course it is denied, because the 192.168.3.91 entry are in the different ACL: IPv4-RO-SNMP-LOCAL

How is this possible? Maybe if the ACL configured earlier with the 70 deny any log entry, denies the new ACL 192.168.3.91 entry too? But this is a two different ACL.

Thanks in advance!

[marce1000]

   - You should start with no ACL's  and then , kind of debugging , check where your ACLs start failing ,

 M.

[khnrjm]

Hello,

Thanks for your feedback!

I've tried everything without luck, and finally I managed to find the problem. The problem was on the NeDi side. I need to run an SNMP v2c connection test, and after that it worked well... it has certainly not worked like that so far. It looks like a bug to me.

[marce1000]

 - If you think it is a bug on the Cisco device , then upgrade to the latest advisory software version and try again,

 M.