AP621 model does not return SNMP data via snmpwalk

[Elias_Morais_Pe]

hello @ckelly, @Christoph_S , @Christopher_Fra , @arichter 

We have 2 RFS6000 controllers and 35 devices of this model in our environment, but I can't retrieve SNMP data from them. We have another 12 devices of the AP7532 model, and I can easily get the information from them.

AP621

$ snmpwalk -v2c -c cti 172.19.0.91 (AP621)
Timeout: No Response from 172.19.0.91

AP7532

$ snmpwalk -v2c -c cti 172.19.0.100
iso.3.6.1.2.1.1.1.0 = STRING: "AP7532 Access Point, Version 5.8.6.9-003R MIB=01a"
iso.3.6.1.2.1.1.2.0 = OID: iso.3.6.1.4.1.388.50.1.1.40
iso.3.6.1.2.1.1.3.0 = Timeticks: (24005400) 2 days, 18:40:54.00
iso.3.6.1.2.1.1.4.0 = ""
iso.3.6.1.2.1.1.5.0 = STRING: "AP-A13-1314"

What is blocking the AP621 model? How can this be fixed?

EDIT:

I tried to follow the steps in the link below, but an error occurred. I think it's a bug.
https://extremeportal.force.com/ExtrArticleDetail?an=000094294

rfs01(config)*#ip snmp-access-list cti
rfs01(config-ip-snmp-acl-cti)*#permit any
% Error: Invalid IPv4/mask format
rfs01(config-ip-snmp-acl-cti)*#permit ?
  A.B.C.D/M  Source IP address range to match
  any        Any source IP address
  host       Single host address

rfs01(config-ip-snmp-acl-cti)*#permit any ?
  <cr>

rfs01(config-ip-snmp-acl-cti)*#permit any 
% Error: Invalid IPv4/mask format

Thank you in advance!!!

[ckelly]

Okay, so nmap is showing that port 161 is closed, that explains the general failure. Just need to understand WHY that port is down. If you want to confirm that this nmap info is correct, run the same scan against one of the working 7532's. The STATE should show as OPEN.

Otherwise, the config looks good.

Can you confirm though that the snmpwalk attempts are originating from one of these host or networks listed in the config?

ip snmp-access-list cti
permit host 200.x.x.x
permit 200.x.x.0/24
permit 10.x.0.0/23
permit host 10.60.0.7

[Elias_Morais_Pe]

@ckelly 

ap7532

elias@elias:~$ sudo nmap -sU -p 161 172.19.0.97
Starting Nmap 7.80 ( https://nmap.org ) at 2023-09-27 12:03 -03
Nmap scan report for 172.19.0.97
Host is up (0.00069s latency).

PORT    STATE         SERVICE
161/udp open|filtered snmp

Nmap done: 1 IP address (1 host up) scanned in 0.38 seconds

The IP 10.60.0.7 is the IP address of my work machine.
The IP ending in .138 is the Zabbix.
The /24 range consists of the public IPs we use.

[ckelly]

Yes. I do not have a 621, but do have a 622 which is just a dual radio version of the 621.

As far as I know, there should not be any differences in behavior between the two models other than the extra radio on the 622.

I can try to match exactly the firmware version you are running. There's always the possibility that an issue was introduced in your version, which came slightly after the one I am using.

[Elias_Morais_Pe]

---

@ckelly wrote:

I can try to match exactly the firmware version you are running. There's always the possibility that an issue was introduced in your version, which came slightly after the one I am using.

---

hello @ckelly ,

Did you manage to perform the tests with the same firmware that I use?

[ckelly]

Yes, I've confirmed that with the image 5.8.6.9 my AP622 does correctly respond to an snmpwalk.

Assuming there are no issues with ACLs or anything blocking the SNMP traffic to these APs, my next guess would be that there is some sort of difference between the AP622 and AP621 that I'm not aware of. Unfortunately, I don't have an AP621 to test with.