SNMPv3 hit count = 0

[h.dam]

Hi everyone,

I've configured snmpv3 client on my ASA with policies snmp and snmptrap.

I found there are only snmptrap traffic from a switch (also configured snmpv3) on ASDM but snmp hit count stays 0.

Then I run packet captures on this ASA ingress/engress traffic between NMS server and this switch.

I saw traffic with ports 161, 162 talking between them => So ASA does its job well.

My issue is: why I don't have traffic on snmp policy line while I saw it in wireshark capture.

The policy is very simple. source = NMS server --> destination = client port 161

ASA version is 9.8(1), ASDM is 7.8(1)

Thanks.

Regards.

[h.dam]

Hi,

I'm thinking about the difference between snmptrap (which matches the policy line) and snmp (which didn' match).

snmptrap is v2, clear txt and unidirectional

snmp is v3, encrypted and bidirectional

Here's the snmp config on ASA:

snmp-server group <groupname> v3 priv
snmp-server user <username> <groupname> v3 encrypted auth sha <auth-passwd> priv aes 128 <my-passwd>

snmp-server host <interface> 10.x.x.x version 3 <username>

snmp-server contact 1.0
snmp-server community *****
snmp-server enable traps config

Should I delete contact and/or community?

Regards.

[h.dam]

I have just deleted snmp location, contact and community since snmp v3 doesn't use them.

The issue is still there. I can only see snmptrap but snmp hit=0.

In logging, I found %ASA-6-110002 error

"Failed to local egress interface for protocol from src" --> udp/161

I conclude that it is a routing issue between zones. 

I have configured them with security-level 100 and globally "same-security-traffic permit inter-interface".

Anyone can help?

Regards.

[h.dam]

Hello,

By using packet tracer and wireshark, I found the snmp traffic going in and out the FW (but no hit-count changes)

On the NMS server side, if I run polling to devices, the snmp hit-count increases this time.

The server is configured to poll every second. But if I do nothing the hit-count stays stable. I don't know if it is the FW security feature.

Anyway, snmp works well.

Regards.