某局点SR6602I snmp告警团体字不匹配问题经验案例

snmp-agent community read cipher $c$3$pSq+0KLSRACKon3eu4Bz1dcl+ZzH+aIL43eZpQ== acl 2222

现网设备配置了snmp community read X acl Y，对访问设备的snmp request进行community和acl的检查。

配置后，网管经常收到snmp trap告警团体字不匹配，snmp request源ip不在acl范围内。

snmp community read X acl Y配置对应的community检查在acl检查之前，community检查失败就产生trap，无法通过acl过滤。

示例1，community错误的snmp reqeust到达设备时，debug snmp agent 结果：

*Mar 21 15:20:57:586 2022 SR6602I SNMP/7/STACK_ERROR:

Invalid community name publictest

*Mar 21 15:20:57:586 2022 SR6602I SNMP/7/STACK_ERROR:

Failed to check community name publictest's access right (PDU type: 161, error code: 1)

示例2，community正确、acl不匹配的snmp request到达设备时，debug结果：

*Mar 21 15:22:10:822 2022 SR6602I SNMP/7/HEADER:

Incoming SNMPv2c packet

Community name: public

*Mar 21 15:22:10:822 2022 SR6602I SNMP/7/PACKET_SRC:

Packet received from 192.168.214.13 via UDP

*Mar 21 15:22:10:822 2022 SR6602I SNMP/7/PACKET:

Get-next request

Request ID: 4

Error status: 0

Error index: 0

*Mar 21 15:22:10:822 2022 SR6602I SNMP/7/VBLIST:

sysUpTime:

*Mar 21 15:22:10:822 2022 SR6602I SNMP/7/STACK_ERROR:

Failed to check community public's acl 3000

建议网管忽略该trap，或者设备上关掉该trap。

undo snmp-agent trap enable standard authentication