snmpv3 Error reading Mac-Adresses of Switch

[smorandell]

Hello everyone,
I have the following issue:
We are using a Network Access Control solution that reads data from our Cisco switches via SNMPv3. This works fine on all switches except for two, which have a problem when reading certain MIBs.
The following error message appears:
SnmpException: Error while reading [1.3.6.1.2.1.17.4.3.1.2, 1.3.6.1.2.1.17.4.3.1.3] from <IP-Address Switch> (ctx 1): Authorization error, code 16 (see logs for details)

SNMP access to the two switches is generally working, as other data can be read from them. Only reading the BridgeMIB CSI fails. Permissions should be correct (since it works on other switches).

Here is the configuration I am using:

View:
ALL_ACCESS iso - included nonvolatile active

Group:
groupname: test
security model: v3 priv
contextname: <no context specified>
storage-type: nonvolatile
readview: ALL_ACCESS
writeview: <no writeview specified>
notifyview: <no notifyview specified>
row status: active

User:
User name: test
Engine ID: 800000090300084FF9B19A81
storage-type: nonvolatile active
Authentication Protocol: SHA
Privacy Protocol: AES128
Group-name: test

The problem occurs on the following switch model and version:
Model: WS-C2960X-48FPS-L
SW Version: 15.2.(4) E8
SW Image: C2960X-UNIVERSALK9-M

Does anyone have a solution for this issue?

I also tried creating a user and a group without restrictions on specific MIBs, but it still doesn't work. SNMPv2 works perfectly fine.

Thank you for your help!

[marce1000]

  - Check this out : https://kb.paessler.com/en/topic/4353-snmp-authorization-error-snmp-error-16

  M.

[smorandell]

Unfortunately, it doesn't work. I am already using the same group name and user group name as you can see in my post above.

[Joshqun Ismayilov]

Hello @smorandell 

Is It the same ios version with the working and no-working switch?

Thanks!

[vishalbhandari]

@smorandell 

It seems the issue is related to SNMPv3 authorization when accessing the Bridge MIB on your two WS-C2960X-48FPS-L switches. Since SNMPv3 works for other MIBs, the problem likely lies in how the SNMP views are configured. Even though you’ve set ALL_ACCESS to include iso, some IOS versions have stricter controls for the Bridge MIB, requiring explicit permissions. Try modifying your SNMP view to explicitly include the Bridge MIB OIDs:

snmp-server view ALL_ACCESS iso included

snmp-server view ALL_ACCESS 1.3.6.1.2.1.17 included

Then reapply the view to your SNMP group. Also, check if the context is required for Bridge MIB access on these switches by specifying it explicitly in your NAC solution. If the issue persists, compare the SNMP configurations of the working switches with these two for any subtle differences.