topic RE: SNMP Error #2003 in ExtremeSwitching (EXOS/Switch Engine)

SNMP Error #2003

Ghost1081 — Sun, 29 Jan 2017 15:59:00 GMT

Hello togehter,

i have an extreme switch an would like to use snmp.
my snmp config looks like this:

problem is:
my snmp test tool says: Error #2003
What can i do now?

RE: SNMP Error #2003

davidj_cogliane — Sun, 29 Jan 2017 20:14:00 GMT

What model switch do you have? What code version are you running? I don't see any community strings in that screen shot. Can you run [show configuration SNMP] and share that output?

RE: SNMP Error #2003

Ghost1081 — Sun, 29 Jan 2017 22:05:00 GMT

model: x250e-48t

Conf SNMP

#
# Module snmpMaster configuration.
#
configure snmpv3 add group "v1v2cNotifyGroup" user "v1v2cNotifyUser1" sec-model snmpv2c
disable snmpv3 community "public"
configure snmpv3 add community "v1v2cNotifyComm1" name "public" user "v1v2cNotifyUser1"
configure snmpv3 add target-addr "v1v2cNotifyTAddr1" param "v1v2cNotifyParam1" ipaddress xxx.xxx.xxx.xxx
70 transport-port from xxx.xxx.xxx.xxx tag-list "defaultNotify"
configure snmpv3 add target-params "v1v2cNotifyParam1" user "v1v2cNotifyUser1" mp-model snmpv2c sec-
model snmpv2c sec-level noauth
configure snmpv3 add notify "defaultnotify" tag "defaultnotify"
disable snmpv3 default-group

RE: SNMP Error #2003

Ghost1081 — Sun, 29 Jan 2017 22:05:00 GMT

how i get the code version?

RE: SNMP Error #2003

davidj_cogliane — Sun, 29 Jan 2017 22:05:00 GMT

Show version image

RE: SNMP Error #2003

Ghost1081 — Sun, 29 Jan 2017 22:05:00 GMT

15.2.3.2

RE: SNMP Error #2003

davidj_cogliane — Sun, 29 Jan 2017 22:30:00 GMT

I see V3 disabled and I don't see any custom SNMP community strings for V2. I assume you have the tool configured for the default community strings. Is there a user guide for the tool you are using? It would be good to clerified why the tool is giving you that error. You can see the default configuration with Show configuration SNMP detail.

RE: SNMP Error #2003

Prashanth_KG — Sun, 29 Jan 2017 22:31:00 GMT

Hi,

Based on my quick research, the error 2003 could be related to the connectivity issues or limited access to the SNMP on the switch or wrong community setting etc.,

Looking at the configuration, I see that the default snmpv3 groups and communities are disabled.

disable snmpv3 community "public"
disable snmpv3 default-group

Is this the complete configuration that you have on the device that you have shared with us? If that is the case, please try to enable these 2 and check if that helps!

enable snmpv3 community public
enable snmpv3 default-group.

Also, please share the "show log match snmp" output from the switch at the time of the error on the SNMP tester.

Hope this helps!

RE: SNMP Error #2003

Ronald_Dvorak — Sun, 29 Jan 2017 22:33:00 GMT

I don't see a SNMP user in the your config that refers to the group - first command in the below picture

Here two links on to how to setup SNMPv3...

https://gtacknowledge.extremenetworks.com/articles/How_To/How-to-set-up-SNMPv3-on-EXOS
https://gtacknowledge.extremenetworks.com/articles/How_To/How-to-configure-SNMPv3-informs-in-EXOS

I've put together my own table (as the KB wasn't very clear to me) to show which "variables" interact which each other - so here a picture - so the the same colour must have the same name to work with the other commands.

I'd delete the SNMP config and start from scratch.

RE: SNMP Error #2003

Ghost1081 — Sun, 29 Jan 2017 22:40:00 GMT

Please look at the result of "show conf snmp detail"

#
# Module snmpMaster configuration.
#
configure snmpv3 engine-id 03:02:04:96:37:44:77
configure snmp compatibility get-bulk reply-too-big-action too-big-error
configure snmp compatibility ip-fragmentation disallow
configure snmpv3 add user "admin" engine-id 80:00:07:7c:03:02:04:96:37:44:77 authentication md5 auth
-encrypted localized-key XXX
configure snmpv3 add user "initial" engine-id 80:00:07:7c:03:02:04:96:37:44:77
configure snmpv3 add user "initialmd5" engine-id 80:00:07:7c:03:02:04:96:37:44:77 authentication md5
auth-encrypted localized-key XXX
configure snmpv3 add user "initialsha" engine-id 80:00:07:7c:03:02:04:96:37:44:77 authentication sha
auth-encrypted localized-key XXX
configure snmpv3 add user "initialmd5Priv" engine-id 80:00:07:7c:03:02:04:96:37:44:77 authentication
md5 auth-encrypted localized-key XXXX
configure snmpv3 add user "initialshaPriv" engine-id 80:00:07:7c:03:02:04:96:37:44:77 authentication
sha auth-encrypted localized-key XXX privacy privacy-encrypted localized-key XXX
configure snmpv3 add group "v1v2c_ro" user "v1v2c_ro" sec-model snmpv1
configure snmpv3 add group "v1v2c_rw" user "v1v2c_rw" sec-model snmpv1
configure snmpv3 add group "v1v2c_ro" user "v1v2c_ro" sec-model snmpv2c
configure snmpv3 add group "v1v2c_rw" user "v1v2c_rw" sec-model snmpv2c
configure snmpv3 add group "v1v2cNotifyGroup" user "v1v2cNotifyUser1" sec-model snmpv2c
configure snmpv3 add group "admin" user "admin" sec-model usm
configure snmpv3 add group "initial" user "initial" sec-model usm
configure snmpv3 add group "initial" user "initialmd5" sec-model usm
configure snmpv3 add group "initial" user "initialsha" sec-model usm
configure snmpv3 add group "initial" user "initialmd5Priv" sec-model usm
configure snmpv3 add group "initial" user "initialshaPriv" sec-model usm
configure snmpv3 add access "admin" sec-model usm sec-level priv read-view "defaultAdminView" write-
view "defaultAdminView" notify-view "defaultNotifyView"
configure snmpv3 add access "initial" sec-model usm sec-level noauth read-view "defaultUserView" not
ify-view "defaultNotifyView"
configure snmpv3 add access "initial" sec-model usm sec-level authnopriv read-view "defaultUserView"
write-view "defaultUserView" notify-view "defaultNotifyView"
configure snmpv3 add access "v1v2c_ro" sec-model snmpv1 sec-level noauth read-view "defaultUserView"
notify-view "defaultNotifyView"
configure snmpv3 add access "v1v2c_ro" sec-model snmpv2c sec-level noauth read-view "defaultUserView
" notify-view "defaultNotifyView"
configure snmpv3 add access "v1v2c_rw" sec-model snmpv1 sec-level noauth read-view "defaultUserView"
write-view "defaultUserView" notify-view "defaultNotifyView"
configure snmpv3 add access "v1v2c_rw" sec-model snmpv2c sec-level noauth read-view "defaultUserView
" write-view "defaultUserView" notify-view "defaultNotifyView"
configure snmpv3 add access "v1v2cNotifyGroup" sec-model snmpv1 sec-level noauth notify-view "defaul
tNotifyView"
configure snmpv3 add access "v1v2cNotifyGroup" sec-model snmpv2c sec-level noauth notify-view "defau
ltNotifyView"
configure snmpv3 add mib-view "defaultUserView" subtree 1.0/80 type included
configure snmpv3 add mib-view "defaultUserView" subtree 1.3.6.1.6.3.16 type excluded
configure snmpv3 add mib-view "defaultUserView" subtree 1.3.6.1.6.3.18 type excluded
configure snmpv3 add mib-view "defaultUserView" subtree 1.3.6.1.6.3.15.1.2.2.1.4 type excluded
configure snmpv3 add mib-view "defaultUserView" subtree 1.3.6.1.6.3.15.1.2.2.1.6 type excluded
configure snmpv3 add mib-view "defaultUserView" subtree 1.3.6.1.6.3.15.1.2.2.1.9 type excluded
configure snmpv3 add mib-view "defaultAdminView" subtree 1.0/80 type included
configure snmpv3 add mib-view "defaultNotifyView" subtree 1.0/80 type included
configure snmpv3 add community "private" name "private" user "v1v2c_rw"
configure snmpv3 add community "public" name "public" user "v1v2c_ro"
disable snmpv3 community "public"
configure snmpv3 add community "v1v2cNotifyComm1" name "public" user "v1v2cNotifyUser1"
configure snmpv3 add target-addr "v1v2cNotifyTAddr1" param "v1v2cNotifyParam1" ipaddress XXX
70 transport-port 10550 from XXX tag-list "defaultNotify"
configure snmpv3 target-addr "v1v2cNotifyTAddr1" timeout 15
configure snmpv3 target-addr "v1v2cNotifyTAddr1" retry 3
configure snmpv3 add target-params "v1v2cNotifyParam1" user "v1v2cNotifyUser1" mp-model snmpv2c sec-
model snmpv2c sec-level noauth
configure snmpv3 add notify "defaultNotify" tag "defaultNotify"
configure snmpv3 add notify "defaultnotify" tag "defaultnotify"
enable snmp access
enable snmp access snmp-v1v2c
enable snmp access snmpv3
disable snmpv3 default-group
enable snmpv3 default-user
enable snmp traps
configure snmp access-profile none
enable snmp access vr "VR-Default"
enable snmp access vr "VR-Mgmt"

And this is the output of a switch which works fine with snmp.
i only use and test it with snmp v1

#
# Module snmpMaster configuration.
#
configure snmpv3 engine-id 03:02:04:96:36:f9:3c
configure snmp compatibility get-bulk reply-too-big-action too-big-error
configure snmp compatibility ip-fragmentation disallow
configure snmpv3 add user "admin" engine-id 80:00:07:7c:03:02:04:96:36:f9:3c authentication md5 auth
-encrypted localized-key XXX privac
y privacy-encrypted localized-key XXX
configure snmpv3 add user "initial" engine-id 80:00:07:7c:03:02:04:96:36:f9:3c
configure snmpv3 add user "initialmd5" engine-id 80:00:07:7c:03:02:04:96:36:f9:3c authentication md5
auth-encrypted localized-key XXX
configure snmpv3 add user "initialsha" engine-id 80:00:07:7c:03:02:04:96:36:f9:3c authentication sha
auth-encrypted localized-key XXX
configure snmpv3 add user "initialmd5Priv" engine-id 80:00:07:7c:03:02:04:96:36:f9:3c authentication
md5 auth-encrypted localized-key XXX privacy privacy-encrypted localized-key XXX
configure snmpv3 add user "initialshaPriv" engine-id 80:00:07:7c:03:02:04:96:36:f9:3c authentication
sha auth-encrypted localized-key XXX
configure snmpv3 add group "v1v2c_ro" user "v1v2c_ro" sec-model snmpv1
configure snmpv3 add group "v1v2c_rw" user "v1v2c_rw" sec-model snmpv1
configure snmpv3 add group "v1v2c_ro" user "v1v2c_ro" sec-model snmpv2c
configure snmpv3 add group "v1v2c_rw" user "v1v2c_rw" sec-model snmpv2c
configure snmpv3 add group "v1v2cNotifyGroup" user "v1v2cNotifyUser1" sec-model snmpv2c
configure snmpv3 add group "admin" user "admin" sec-model usm
configure snmpv3 add group "initial" user "initial" sec-model usm
configure snmpv3 add group "initial" user "initialmd5" sec-model usm
configure snmpv3 add group "initial" user "initialsha" sec-model usm
configure snmpv3 add group "initial" user "initialmd5Priv" sec-model usm
configure snmpv3 add group "initial" user "initialshaPriv" sec-model usm
configure snmpv3 add access "admin" sec-model usm sec-level priv read-view "defaultAdminView" write-
view "defaultAdminView" notify-view "defaultNotifyView"
configure snmpv3 add access "initial" sec-model usm sec-level noauth read-view "defaultUserView" not
ify-view "defaultNotifyView"
configure snmpv3 add access "initial" sec-model usm sec-level authnopriv read-view "defaultUserView"
write-view "defaultUserView" notify-view "defaultNotifyView"
configure snmpv3 add access "v1v2c_ro" sec-model snmpv1 sec-level noauth read-view "defaultUserView"
notify-view "defaultNotifyView"
configure snmpv3 add access "v1v2c_ro" sec-model snmpv2c sec-level noauth read-view "defaultUserView
" notify-view "defaultNotifyView"
configure snmpv3 add access "v1v2c_rw" sec-model snmpv1 sec-level noauth read-view "defaultUserView"
write-view "defaultUserView" notify-view "defaultNotifyView"
configure snmpv3 add access "v1v2c_rw" sec-model snmpv2c sec-level noauth read-view "defaultUserView
" write-view "defaultUserView" notify-view "defaultNotifyView"
configure snmpv3 add access "v1v2cNotifyGroup" sec-model snmpv1 sec-level noauth notify-view "defaul
tNotifyView"
configure snmpv3 add access "v1v2cNotifyGroup" sec-model snmpv2c sec-level noauth notify-view "defau
ltNotifyView"
configure snmpv3 add mib-view "defaultUserView" subtree 1.0/80 type included
configure snmpv3 add mib-view "defaultUserView" subtree 1.3.6.1.6.3.16 type excluded
configure snmpv3 add mib-view "defaultUserView" subtree 1.3.6.1.6.3.18 type excluded
configure snmpv3 add mib-view "defaultUserView" subtree 1.3.6.1.6.3.15.1.2.2.1.4 type excluded
configure snmpv3 add mib-view "defaultUserView" subtree 1.3.6.1.6.3.15.1.2.2.1.6 type excluded
configure snmpv3 add mib-view "defaultUserView" subtree 1.3.6.1.6.3.15.1.2.2.1.9 type excluded
configure snmpv3 add mib-view "defaultAdminView" subtree 1.0/80 type included
configure snmpv3 add mib-view "defaultNotifyView" subtree 1.0/80 type included
configure snmpv3 add community "private" name "private" user "v1v2c_rw"
configure snmpv3 add community "public" name "public" user "v1v2c_ro"
configure snmpv3 add community "v1v2cNotifyComm1" name "ST.-1062731350.10550" user "v1v2cNotifyUser1
"
configure snmpv3 add target-addr "v1v2cNotifyTAddr1" param "v1v2cNotifyParam1" ipaddress XXX
70 transport-port 10550 from XXX tag-list "defaultNotify"
configure snmpv3 target-addr "v1v2cNotifyTAddr1" timeout 15
configure snmpv3 target-addr "v1v2cNotifyTAddr1" retry 3
configure snmpv3 add target-params "v1v2cNotifyParam1" user "v1v2cNotifyUser1" mp-model snmpv2c sec-
model snmpv2c sec-level noauth
configure snmpv3 add notify "defaultNotify" tag "defaultNotify"
enable snmp access
enable snmp access snmp-v1v2c
disable snmp access snmpv3
enable snmpv3 default-group
enable snmpv3 default-user
enable snmp traps
configure snmp access-profile none
enable snmp access vr "VR-Default"
enable snmp access vr "VR-Mgmt"

RE: SNMP Error #2003

Ariyakudi_Srini — Mon, 30 Jan 2017 10:06:00 GMT

Hi,

The switch does seem to have the necessary configuration for the user's "public" and "private",

configure snmpv3 add community "private" name "private" user "v1v2c_rw"
configure snmpv3 add community "public" name "public" user "v1v2c_ro"

Now, as long as there is no network related issue, we should have no problem with the SNMP being functional.

Just to test, the counters across the switch can be cleared with the command "clear counters" and try to test the connectivity and verify if the SNMP is functional from the output of "show management".
The part of the output of interest is as below to check if there are any errors, drops.

SNMP stats: InPkts 0 OutPkts 0 Errors 0 AuthErrors 0
Gets 0 GetNexts 0 Sets 0 Drops 0
SNMP traps: Sent 0 AuthTraps Enabled
SNMP inform: Sent 0 Retries 0 Failed 0

RE: SNMP Error #2003

Ghost1081 — Mon, 30 Jan 2017 13:34:00 GMT

i cleared the counters.
after a new snmp test it looks like this:

RE: SNMP Error #2003

Ariyakudi_Srini — Mon, 30 Jan 2017 16:21:00 GMT

Hi,

Please provide the output of "show log match snmp" from the switch.
Let's confirm if there are any community mismatch issue with the switch.

RE: SNMP Error #2003

Prashanth_KG — Mon, 30 Jan 2017 19:12:00 GMT

HI,

The output of snmp counters indicate that there are authentication errors.

It looks like a community mismatch. Please ensure you are using the same community name in the tool and the switch.
Also, please enable the default user and group in SNMP and let us know if that helps!

RE: SNMP Error #2003

Ghost1081 — Mon, 30 Jan 2017 21:21:00 GMT

01/23/2017 07:55:41.59 Slot-1: SNMP access from source is denied by rule PolSNMPAccess. Dropping this Request.

RE: SNMP Error #2003

Ariyakudi_Srini — Mon, 30 Jan 2017 22:39:00 GMT

Hi,

The log provides means the SNMP access from the specified source is denied by Policy Manager or access-list rule. Dropping this SNMP Request.

There does not seem to be any access-profile configured is what i see from the provided screenshot of the "show management".
And the drop could be due to any ACL that has been configured and applied at the switch.

RE: SNMP Error #2003

Ghost1081 — Mon, 30 Jan 2017 23:52:00 GMT

sry, but what i have to do now?
i am new in the extreme world 

RE: SNMP Error #2003

Ariyakudi_Srini — Tue, 31 Jan 2017 07:35:00 GMT

Hi,

Please check if there are any ACL's applied in the switch to deny traffic from a particular source or subnet.

- output of "show configuration acl" will give you the information of the configured ACL.

If the switch has been configured with any access-list, please check the particular access-list that has the IP address of the NMS in it, and understand as to why the SNMP request from that source is getting dropped, say if it is expected. The output of "show policy " will give you the configuration of the policy file.

Also let us know what is the NMS that you are using.

RE: SNMP Error #2003

Ghost1081 — Tue, 31 Jan 2017 13:51:00 GMT

Output of show config acl

configure access-list zone SYSTEM application NetLogin application-priority 4
configure access-list zone SYSTEM application HealthCheckLAG application-priority 5
configure access-list zone SYSTEM application IdentityManager application-priority 6
configure access-list zone SYSTEM application VMTracking application-priority 7
configure access-list zone SYSTEM application PolicyManager application-priority 8
configure access-list zone SYSTEM application Snmp application-priority 11
configure access-list zone SYSTEM application Telnet application-priority 12
configure access-list zone SYSTEM application Http application-priority 13
configure access-list zone SYSTEM application Ssh2 application-priority 14

RE: SNMP Error #2003

Ariyakudi_Srini — Tue, 31 Jan 2017 14:15:00 GMT

Hi,

The IP address from the log message and the IP configured at the NMS, are they the same?

Also, the log message states that the request is dropped as it was hitting the policy "PolSNMPAccess", but the output of acl configuration you have shared does not seem to have the acl configured in it.

Are we sure the output of "show configuration acl" is from the same switch where the previously provided log message was provided from?