Re: SNMPv3: two request needed to get response(msgAuth oritativeEngineTime)?

> -----Ursprüngliche Nachricht-----
> Von: "Dave Shield" <[email protected]>
> Gesendet: 26.03.09 10:46:19
> An: mike one <[email protected]>
> CC: "[email protected]" <[email protected]>
> Betreff: Re: SNMPv3: two request needed to get response(msgAuthoritativeEngineTime)?


>     [ First - *please* don't mail me privately, without copying
>      any responses to the mailing list.  I don't have the time
>      or inclination to offer private, unpaid, SNMP consultancy.
>      Keep discussions to the list, where others can both learn
>      and offer advice.  Thanks.   ]
> 2009/3/26 mike one <[email protected]>:
> > Dave,
> >
> > THANKS for clarification!!!
> >
> >> Any subsequent request from the same management application
> >> should succeed, without the need for another probe (unless the
> >> agent has restarted in the meantime)
> > I use Nagios for switches management, Nagios used NET-SNMP via plugins : snmpget.
> > Do I need to configure Net-SNMP for v3 on Nagios-server?
> > Because any time I do snmpget from Nagios-server I get AuthenticationFailure from switch.
> > You are right: for instance by snmpdelta any subsequent request is succeeded!
> > But I can not use the snmpdelta in nagios requests.
> 
> What is the full content of the error report returned by the switch?
> 
> My suspicion is that the switch is implementing things incorrectly.
> 
> According to my reading of the SNMPv3 specs, the switch ought to
> be returning an error indication of "notInTimeWindow".
>    See step 7 of section 3.2 of RFC 3414
> 
> An authenticationFailure error would only be triggered by step 6,
> which doesn't seem to take notice of the engineBoots/Time values.
> 
> You may need to contact the switch vendors to sort this out.
> 
> 
> 
> As a workaround, see whether the switch supports the MIB object
> SNMPv2-MIB::snmpEnableAuthenTraps,   which can be used to
> suppress the generation of authenticationFailure notifications.
> 
> (It's not actually clear from your message whether you are concerned
> about SNMPv3 REPORT messages, or traps)
> 
> Dave
> 
> ------------------------------------------------------------------------------
> _______________________________________________
> Net-snmp-users mailing list
> [email protected]
> Please see the following page to unsubscribe or change other options:
> https://lists.sourceforge.net/lists/listinfo/net-snmp-users
> 
> 

Hi Dave,

let me so explain my problem: 

RedHat server with net-snmp-5.3.1 (and snmp-utils). 
snmpd is not running.
All switches get the time per ntp from this server.
When I run snmpget from the Linux console (eg. for Nagios) I get the correct response from the switch: 
snmpget -v3 -u snmpuser -l authpriv -a md5 -A abcd1234 -x des -X abcd1234 -e 800019560300E0B19BC33F 172.31.21.98 sysName.0
SNMPv2-MIB::sysName.0 = STRING: TestSwitch

But the switch sends a swnmp trap: Authentication failed

I've traced snmp with wireshark:
1. the first snmp request to the switch contained:
msgAuthoritativeEngineID: 800019560300E0B19BC33F
msgAuthoritativeEngineBoots: 0
msgAuthoritativeEngineTime: 0
2. next cames from the switch snmp report with:
msgAuthoritativeEngineID: 800019560300E0B19BC33F
msgAuthoritativeEngineBoots: 1
msgAuthoritativeEngineTime: 72848
3. second ??? snmp request to the switch contained:
msgAuthoritativeEngineID: 800019560300E0B19BC33F 
msgAuthoritativeEngineBoots: 1
msgAuthoritativeEngineTime: 72848
4. snmp response from switch - OK

The only difference between 1. and 3 is msgAuthoritativeEngineBoots and msgAuthoritativeEngineTime .

I understood that this is normal.
SNMPv3 authentication relies on a synchronisation of "engine uptime"
information between the two sides.

> The first time that the client application tries to query the agent,
> it has no idea of what the engineBoot/Time values ought to be,
> so sends a "probe" request to discover them.
> This probe is actually a copy of the real request (but with 0 values
> for these two fields), and there is no expectation that the request will
> succeed. The purpose is to trigger a failure report message, which
> will include the current engineBoot/Time values for the agent,
> 
> The request can then be sent with these two values inserted, and
> this should allow the agent to authenticate it successfully.
> 
> Any subsequent request from the same management application
> should succeed, without the need for another probe (unless the
> agent has restarted in the meantime)


The question is how to configure my management application (NetSnmp on the RedHat server)
that after the first snmpget request all the following snmpget requests are authorized, without the need for another probe.
So that after first snmpget request (probe) the second and all following snmpget requests will be send with correct engineBoot/Time values.
Need snmpd to be run on the server for that ?

The switches supports snmpEnableAuthenTraps and suppress the generation of authenticationFailure notifications.
But that won't solve my case. It's still needed two snmpget requests to get response.

Thanks in advance !!!

mike

______________________________________________________
GRATIS für alle WEB.DE-Nutzer: Die maxdome Movie-FLAT!
Jetzt freischalten unter http://movieflat.web.de


------------------------------------------------------------------------------
Stay on top of everything new and different, both inside and 
around Java (TM) technology - register by April 22, and save
$200 on the JavaOne (SM) conference, June 2-5, 2009, San Francisco.
300 plus technical and hands-on sessions. Register today. 
Use priority code J9JMT32. http://p.sf.net/sfu/p
_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users