topic Re: AP621 model does not return SNMP data via snmpwalk in ExtremeWireless (WiNG)

AP621 model does not return SNMP data via snmpwalk

Elias_Morais_Pe — Thu, 21 Sep 2023 19:34:29 GMT

hello @ckelly, @Christoph_S , @Christopher_Fra , @arichter

We have 2 RFS6000 controllers and 35 devices of this model in our environment, but I can't retrieve SNMP data from them. We have another 12 devices of the AP7532 model, and I can easily get the information from them.

AP621

$ snmpwalk -v2c -c cti 172.19.0.91 (AP621) Timeout: No Response from 172.19.0.91

AP7532

$ snmpwalk -v2c -c cti 172.19.0.100 iso.3.6.1.2.1.1.1.0 = STRING: "AP7532 Access Point, Version 5.8.6.9-003R MIB=01a" iso.3.6.1.2.1.1.2.0 = OID: iso.3.6.1.4.1.388.50.1.1.40 iso.3.6.1.2.1.1.3.0 = Timeticks: (24005400) 2 days, 18:40:54.00 iso.3.6.1.2.1.1.4.0 = "" iso.3.6.1.2.1.1.5.0 = STRING: "AP-A13-1314"

What is blocking the AP621 model? How can this be fixed?

EDIT:

I tried to follow the steps in the link below, but an error occurred. I think it's a bug.
https://extremeportal.force.com/ExtrArticleDetail?an=000094294

rfs01(config)*#ip snmp-access-list cti rfs01(config-ip-snmp-acl-cti)*#permit any % Error: Invalid IPv4/mask format rfs01(config-ip-snmp-acl-cti)*#permit ? A.B.C.D/M Source IP address range to match any Any source IP address host Single host address rfs01(config-ip-snmp-acl-cti)*#permit any ? <cr> rfs01(config-ip-snmp-acl-cti)*#permit any % Error: Invalid IPv4/mask format

Thank you in advance!!!

Re: AP621 model does not return SNMP data via snmpwalk

ckelly — Thu, 21 Sep 2023 19:43:57 GMT

Is the management policy that is assigned to the 621 the same one that is applied to the 7532?

Re: AP621 model does not return SNMP data via snmpwalk

Elias_Morais_Pe — Fri, 22 Sep 2023 11:18:37 GMT

hello @ckelly , thanks for the help!!!

Yes, it's the same.

Re: AP621 model does not return SNMP data via snmpwalk

ckelly — Fri, 22 Sep 2023 14:08:49 GMT

I have tested a 622 running 5.8.6.2 and I can successfully walk the AP.

Do you have any override values on the 622 that relate to SNMP?

The timeout could be seen if attempting to walk the wrong address....or if the community string value is incorrect (which is why I asked if the same management profile was applied). There's still the potential though that there may be an override setting on the 622 that affects the SNMP settings.

If you have other 622's, are they also exhibiting this same behavior?

I AM able to replicate the syntax issue you are seeing with attempting to use the 'any' option with the access-list. I didn't see this issue with an earlier release of WiNG code though. In the meantime, you could use either the host option or the subnet option and just specify the entire network if necessary.

Re: AP621 model does not return SNMP data via snmpwalk

Elias_Morais_Pe — Fri, 22 Sep 2023 17:40:08 GMT

hello @ckelly

We have 36 APs of the 621 model. Is it the same series as the model 622 you tested?

The settings are correct. It pings, but it doesn't return SNMP.

elias@elias:~$ ping 172.19.0.91 PING 172.19.0.91 (172.19.0.91) 56(84) bytes of data. 64 bytes from 172.19.0.91: icmp_seq=1 ttl=63 time=0.717 ms 64 bytes from 172.19.0.91: icmp_seq=2 ttl=63 time=0.494 ms 64 bytes from 172.19.0.91: icmp_seq=3 ttl=63 time=0.492 ms ^C --- 172.19.0.91 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2040ms rtt min/avg/max/mdev = 0.492/0.567/0.717/0.105 ms elias@elias:~$ snmpwalk -v2c -c cti 172.19.0.91 Timeout: No Response from 172.19.0.91

Re: AP621 model does not return SNMP data via snmpwalk

ckelly — Fri, 22 Sep 2023 17:50:28 GMT

Yes. I do not have a 621, but do have a 622 which is just a dual radio version of the 621.

As far as I know, there should not be any differences in behavior between the two models other than the extra radio on the 622.

I can try to match exactly the firmware version you are running. There's always the possibility that an issue was introduced in your version, which came slightly after the one I am using.

Re: AP621 model does not return SNMP data via snmpwalk

Elias_Morais_Pe — Mon, 25 Sep 2023 13:22:24 GMT

@ckelly wrote:
I can try to match exactly the firmware version you are running. There's always the possibility that an issue was introduced in your version, which came slightly after the one I am using.

hello @ckelly ,

Did you manage to perform the tests with the same firmware that I use?

Re: AP621 model does not return SNMP data via snmpwalk

ckelly — Mon, 25 Sep 2023 13:48:01 GMT

Yes, I've confirmed that with the image 5.8.6.9 my AP622 does correctly respond to an snmpwalk.

Assuming there are no issues with ACLs or anything blocking the SNMP traffic to these APs, my next guess would be that there is some sort of difference between the AP622 and AP621 that I'm not aware of. Unfortunately, I don't have an AP621 to test with.

Re: AP621 model does not return SNMP data via snmpwalk

Elias_Morais_Pe — Wed, 27 Sep 2023 14:13:02 GMT

@ckelly wrote:
Yes, I've confirmed that with the image 5.8.6.9 my AP622 does correctly respond to an snmpwalk.
Assuming there are no issues with ACLs or anything blocking the SNMP traffic to these APs, my next guess would be that there is some sort of difference between the AP622 and AP621 that I'm not aware of. Unfortunately, I don't have an AP621 to test with.

@ckelly

Thank you for the feedback!

The issue is that we have many of these models, and we need to monitor them with our Zabbix. Our educational institution is located in a rural area, and the access points (APs) are spread across a vast area.

We don't have the budget to purchase a new controller because the AP 621 wouldn't be compatible.

What I would need is the release of the latest firmware version that this AP supports to try to resolve this. I've already requested this through GTAC, but I always receive the same response that they cannot release it because we don't have a contract.

What can we do to resolve this issue, which, in my opinion, is related to the equipment?

Re: AP621 model does not return SNMP data via snmpwalk

ckelly — Wed, 27 Sep 2023 14:20:10 GMT

Unfortunately, I cannot help with providing firmware images.

The only other thing I can think of is to look at a copy of your complete running config from one of the AP621's. There might possibly be something in the config that is causing this.

Or...can you run a port scan against the AP621(using any one of many different utilities available) to check to see if port 161 is showing as open?

Re: AP621 model does not return SNMP data via snmpwalk

Elias_Morais_Pe — Wed, 27 Sep 2023 14:39:41 GMT

@ckelly

I sent the commands via private message.
Thank you for now!

Re: AP621 model does not return SNMP data via snmpwalk

ckelly — Wed, 27 Sep 2023 15:00:17 GMT

Okay, so nmap is showing that port 161 is closed, that explains the general failure. Just need to understand WHY that port is down. If you want to confirm that this nmap info is correct, run the same scan against one of the working 7532's. The STATE should show as OPEN.

Otherwise, the config looks good.

Can you confirm though that the snmpwalk attempts are originating from one of these host or networks listed in the config?

ip snmp-access-list cti
permit host 200.x.x.x
permit 200.x.x.0/24
permit 10.x.0.0/23
permit host 10.60.0.7

Re: AP621 model does not return SNMP data via snmpwalk

Elias_Morais_Pe — Wed, 27 Sep 2023 17:35:08 GMT

@ckelly

ap7532

elias@elias:~$ sudo nmap -sU -p 161 172.19.0.97 Starting Nmap 7.80 ( https://nmap.org ) at 2023-09-27 12:03 -03 Nmap scan report for 172.19.0.97 Host is up (0.00069s latency). PORT STATE SERVICE 161/udp open|filtered snmp Nmap done: 1 IP address (1 host up) scanned in 0.38 seconds

The IP 10.60.0.7 is the IP address of my work machine.
The IP ending in .138 is the Zabbix.
The /24 range consists of the public IPs we use.

Re: AP621 model does not return SNMP data via snmpwalk

ckelly — Thu, 28 Sep 2023 13:41:41 GMT

So as expected, the 7532 port 161 shows as OPEN.

Also, your workstation address (172.19.0.97) is not an address that would be allowed by SNMP based on the 621's ip snmp-list

Are there any APs responding to snmp (that use the same exact snmp-access-list) that are located on the same network as a 621 that is NOT responding? (trying to eliminate/confirm that this snmp-access-list is the culprit)

ip snmp-access-list cti
permit host 200.x.x.x
permit 200.x.x.0/24
permit 10.x.0.0/23
permit host 10.60.0.7

Re: AP621 model does not return SNMP data via snmpwalk

Elias_Morais_Pe — Fri, 29 Sep 2023 16:44:10 GMT

@ckelly

IP 172.19.0.97 belongs to AP 7532 and is part of the vlan that the APs get IP from. Should the IP itself be on the allowed list?

all 7532 in the image below.

Re: AP621 model does not return SNMP data via snmpwalk

ckelly — Fri, 29 Sep 2023 17:35:04 GMT

The entries in the ip snmp-access-list specify (if using 'permit' entries) which host or networks are allowed for SNMP traffic with an AP.

In this case, your workstation address needs to exist either as a specific host entry in this list OR the network that your workstation is on needs to exist as a network range in the list.

This is what I am trying to confirm. Does your workstation address match any of the four entries in the snmp-access-list?

Re: AP621 model does not return SNMP data via snmpwalk

Elias_Morais_Pe — Fri, 29 Sep 2023 19:29:15 GMT

@ckelly

Yes. My work computer has the IP 10.60.0.7

Re: AP621 model does not return SNMP data via snmpwalk

ckelly — Tue, 03 Oct 2023 13:15:22 GMT

As a test, is it possible to take take an AP621 and factory default it?

Have it boot it and acquire a DHCP address - do not let it adopt to a controller - and then attempt to snmpwalk the AP.

Re: AP621 model does not return SNMP data via snmpwalk

Elias_Morais_Pe — Tue, 03 Oct 2023 15:53:44 GMT

@ckelly

I had already done this, but for peace of mind, I did it again.

It didn't solve the issue. SNMP data is still not returning.

Honestly, I believe with this firmware version, it won't work. We would need to test it with another version.

We know that the problem is clearly in the firmware. It would be interesting for Extreme to release an upgrade to the latest available version or provide a patch for corrections. I understand it's already an end-of-life product, but still, firmware release is the least we expect in a case like this.

What can you do about it? I'm almost begging for the firmware because I've already tried all other attempts.

Re: AP621 model does not return SNMP data via snmpwalk

ckelly — Tue, 03 Oct 2023 20:14:53 GMT

@Christopher_Fra was kind enough to setup a test system using an RFS6000, AP621, and AP7532, all running 5.8.6.9.

He was able to replicate exactly what you are seeing. After discussion, we're fairly certain that due to the reduced memory in the AP621 that along with other features and functions being disabled or reduced in this AP model, that SNMP was also disabled. (This would also explain why my AP622 does respond to an snmpwalk - it does not have the smaller RAM footprint)

Was there ever a time when your AP621's did respond to an snmpwalk?