fpr2130 stoped to answer the snmp on some mibs

[dijix1990]

I have fpr2130 which is working as ASA and some days ago it stoped to answer via snmp, but when I tried to check snmp on it I noticed that snmp was working, but it seemed as fpr2130 lost mibs

For example I checked active node and it was good, snmp works correctly

snmpwalk -v2c -c zabbix 192.168.100.1 sysdescr
SNMPv2-MIB::sysDescr.0 = STRING: Cisco Adaptive Security Appliance Version 9.16(4)18
snmpwalk -v2c -c zabbix 192.168.100.1 ifname
IF-MIB::ifName.2 = STRING: Internal-Data0/1
IF-MIB::ifName.3 = STRING: management
IF-MIB::ifName.4 = STRING: Internal-Data1/1
IF-MIB::ifName.5 = STRING: Ethernet1/1
IF-MIB::ifName.6 = STRING: Ethernet1/2
IF-MIB::ifName.7 = STRING: Ethernet1/3
IF-MIB::ifName.8 = STRING: Ethernet1/4
IF-MIB::ifName.9 = STRING: Ethernet1/5
IF-MIB::ifName.10 = STRING: Ethernet1/6
IF-MIB::ifName.11 = STRING: Ethernet1/7
IF-MIB::ifName.12 = STRING: Ethernet1/8
IF-MIB::ifName.13 = STRING: Ethernet1/9
IF-MIB::ifName.14 = STRING: Ethernet1/10
IF-MIB::ifName.15 = STRING: Ethernet1/11
IF-MIB::ifName.16 = STRING: Port-channel10
IF-MIB::ifName.17 = STRING: Ethernet1/12
IF-MIB::ifName.18 = STRING: Ethernet1/13
IF-MIB::ifName.19 = STRING: Port-channel1
IF-MIB::ifName.20 = STRING: Ethernet1/14
IF-MIB::ifName.21 = STRING: Ethernet1/15
IF-MIB::ifName.22 = STRING: Ethernet1/16
IF-MIB::ifName.23 = STRING: Port-channel1.994
IF-MIB::ifName.24 = STRING: Port-channel1.997
IF-MIB::ifName.25 = STRING: Port-channel10.10
IF-MIB::ifName.26 = STRING: Port-channel10.11

Standby node answers the snmp, but say that doesn't have string sysdescr / ifname

snmpwalk -v2c -c zabbix 192.168.100.2 hrSystemUptime.0
HOST-RESOURCES-MIB::hrSystemUptime.0 = Timeticks: (207330442) 23 days, 23:55:04.42
snmpwalk -v2c -c zabbix 192.168.100.2 sysdescr
SNMPv2-MIB::sysDescr = No Such Object available on this agent at this OID
snmpwalk -v2c -c zabbix 192.168.100.2 ifname
IF-MIB::ifName = No Such Object available on this agent at this OID

strange.. it worked before

[tvotna]

This is something new. Is it for IF-MIB only or other MIBs are also affected? E.g. CISCO-UNIFIED-FIREWALL-MIB or CPU load?

SNMP is total disaster after migration to netsnmp in 9.14 / 6.6. So many bugs:

https://www.cisco.com/web/software/280775065/163160/ASA-9164-Interim-Release-Notes.html

[dijix1990]

not only if-mib. these doesn't work too

CISCO-ENHANCED-MEMPOOL-MIB
CISCO-PROCESS-MIB
CISCO-FIREWALL-MIB
CISCO-UNIFIED-FIREWALL-MIB

[dijix1990]

We prepare to upgrade to 9.18. It's recommended now

[tvotna]

Bug fixes are waterfalled to older releases. E.g. 9.16.4.27 is nearly the same as 9.18.3.46 in terms of bug fixes.

[MHM Cisco World]

As I know 

There are two snmp'

Fxos and lina 

You loss fxos snmp

Do 

Show snmp <<- in fxos 

Also do you mgmt interface 

[tvotna]

snmpwalk -v2c -c zabbix 192.168.100.1 sysdescr
SNMPv2-MIB::sysDescr.0 = STRING: Cisco Adaptive Security Appliance Version 9.16(4)18

This is FXOS in your opinion?

[MHM Cisco World]

as I mention there are two SNMP from FXOS or from LINA 
each one have specific steps to troubleshooting below link help you 

https://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/213971-configure-snmp-on-firepower-ngfw-applian.html

[tvotna]

@MHM Cisco WorldThe question was about ASA. FYI, if ASA is running on Firepower 2100 in appliance mode, FXOS doesn't have SNMP agent accessible from the outside. If ASA is running on Firepower 2100 in platform mode, FXOS does have SNMP agent, but it uses completely different set of MIBs, e.g. CISCO-FIREPOWER-AP-ETHER-MIB for frontpanel ports and backplane interfaces connected to Octeon NPU. IF-MIB gives access only to interfaces connected to Intel CPU, few logical interfaces and management0.

[MHM Cisco World]

FPR with ASA image or with FTD still same SNMP of LINA of FPR with FTD image is same for with ASA image. 
he can use guide I share to check troubleshooting. 

[dijix1990]

it's true for fpr4100/4200/9300 not for 2100 with asa in appliance mode(after converting i don't have FXOS management), for fpr4125 I use general snmp and LINA snmp

[MHM Cisco World]

check the troubleshooting I share above for LINA SNMP

[dijix1990]

I start to think that you didn't read my description about situation, so once again, It worked since about half year. There weren't any configurations which could break snmp. 

The Firepower 2100 runs an underlying operating system called the FXOS. You can run the Firepower 2100 for ASA in the following modes:

• Appliance mode (the default)—Appliance mode lets you configure all settings in the ASA. Only advanced troubleshooting commands are available from the FXOS CLI. See the FXOS troubleshooting guide for more information. The chassis manager is not supported.

By the way it started to work after reboot, so I think it's another one bug

[tvotna]

@dijix1990, you are completely right. This is definitely a bug and mentioned document is not helpful at all to troubleshoot the issue you faced with. Also, this document is not good for FP2100/1000 ASA running in appliance mode. In fact, it is outdated and somebody need to provide feedback on www.cisco.com so that TAC engineers can update it. They also have a nice doc about the appliance mode.

You're also correct that you cannot connect to FXOS SNMP agent from the outside; you can only connect to ASA SNMP agent. By connecting to ASA SNMP agent you can get access to few FXOS MIBs, but not all, and to traditional ASA MIBs.

I've never seen the issue like yours, when ASA responds for certain MIBs, but returns "no such object" for others. There was a bug in older releases with similar symptoms, but it was fixed long ago. You could open a TAC case, but now it's too late if you rebooted. Or you can upgrade blindly, but the issue may re-appear upon some time, no matter if you upgrade to 9.18 or 9.16 latest interim, because they share bug fixes as I mentioned earlier.