snmp is not working on 6850

[mayyola]

i want to ask how to get OS6850(x.x.166.254) snmp data transfer to Centos 7 linux (x.x.166.146)

anyone can help me?

i use snmpwalk -v 2c -c communityee x.x.166.254 on linux but it's no response

i use nmap xx.xx.166.254 find 161 should be open or not

the response follow this :


[root@Flow-166 ~]# nmap xx.xx.166.254

Starting Nmap 6.40 ( http://nmap.org ) at 2019-08-31 21:07 CST
Nmap scan report for 140.117.166.254
Host is up (0.060s latency).
Not shown: 992 closed ports
PORT STATE SERVICE
7/tcp open echo
21/tcp open ftp
22/tcp open ssh
23/tcp open telnet
80/tcp open http
111/tcp open rpcbind
259/tcp filtered esro-gen
443/tcp open https
MAC Address: 00:E0:B1:92:BB:3C (Alcatel-Lucent, Enterprise Business Group)


[root@Flow-166 ~]# nmap -p 161 -sU 140.117.166.254

Starting Nmap 6.40 ( http://nmap.org ) at 2019-08-31 21:12 CST
Nmap scan report for 140.117.166.254
Host is up (0.00068s latency).
PORT STATE SERVICE
161/udp open|filtered snmp (why filtered)
MAC Address: 00:E0:B1:92:BB:3C (Alcatel-Lucent, Enterprise Business Group)

what is the relationship of the os6850 username to centos linux sever?

-> show user
User name = xxxuee,
Password expiration = None,
Read Only for domains = All ,
Read/Write for domains = None,
Snmp allowed = YES,
Snmp authentication = NONE,
Snmp encryption = NONE

-> show configyration snapshot

! AAA :
aaa authentication console "local"
aaa authentication telnet "local"
aaa authentication ftp "local"
aaa authentication http "local"
aaa authentication snmp "local"
aaa authentication ssh "local"

! SNMP :
snmp security no security
snmp community map "Public" user "xxxuee" on
snmp trap absorption disable
snmp station xx.xx.166.146 161 "xxxuee" v2 enable
snmp trap filter xx.xx.166.146 1 2 3 4 5 6
snmp trap filter xx.xx.166.146 7 8 9 10 11 12
snmp trap filter xx.xx.166.146 13 14 15 16 17 18
snmp trap filter xx.xx.166.146 19

-> show snmp station
ipAddress/udpPort status protocol user
---------------------------+---------+--------+-------------------------------
xx.xx.166.146/161 enable v2 xxxuee

[devnull]

You have snmp enabled on the switch?
You need to have
ip service snmp

Code: Select all

show ip service
Name Port Status 
----------------------+-------+---------
ftp 21 enabled 
ssh 22 disabled
telnet 23 disabled
udp-relay 67 disabled
http 80 disabled
network-time 123 disabled
snmp 161 disabled
secure_http 443 enabled

Before your switch is not showing 161 as open it makes no sense to dig deeper here.


CentOS Username is not relying to snmp user at all.
If you query snmpv2 you query the community name "Public" for whatever reason you have to match that community to a existing user with rights (to read data) and snmp enabled - which looks ok as far as i can judge.

[mayyola]

hello,devnull

thx your response..

the snmp service is always enable,and i recode again,it still can't work

i try the snmp of zyxel swtich by centos7 is ok but i don't know why os6850 always can't work

i think the policy no deny the snmp service

hope you can give me some tips to try it

thank you

-> show ip service

Name Port Status
----------------------+-------+---------
ftp 21 enabled
ssh 22 enabled
telnet 23 enabled
udp-relay 67 disabled
http 80 enabled
network-time 123 enabled
snmp 161 enabled
avlan-telnet 259 disabled
avlan-http 260 disabled
avlan-secure-http 261 disabled
secure-http 443 enabled
avlan-http-proxy 262 disabled

-> user snmuser password supervision read-only all no auth
-> aaa authentication snmp "local"
-> snmp security no security
-> snmp community map "public" user "snmpuser" on
-> snmp station x.x.166.146 161 "snmpuser" v2 enable


->show configuration snapshot
! SNMP :
snmp security no security
snmp community map "public" user "snmpuser" on
snmp station x.x.166.146 161 "snmpuser" v2 enable
snmp station x.x.166.187 161 "snmpv1" v2 enable

[root@Flow-166 ~]# snmpwalk -v 2c -c public x.x.166.254 (OS6850 router)
Timeout: No Response from x.x.166.254




-> show user

User name = snmuser,
Password expiration = None,
Read Only for domains = All ,
Read/Write for domains = None,
Snmp allowed = YES,
Snmp authentication = NONE,
Snmp encryption = NONE

-> show snmp station
ipAddress/udpPort status protocol user
---------------------------+---------+--------+-------------------------------
x.x.166.146/161 enable v2 snmpuser
x.x.166.187/161 enable v2 snmpv1

[devnull]

is snmuser instead of snmpuser a typo when copying or a mistake in your config? you need to map to an existing user, snmuser and snmpuser is not the same.

Why do you use Port 161 for snmp station (traps) while the default is 162? it should not be a problem, but you can first try without station (this command is used for sending snmp traps to the station).

try to remove everything related snmp. all snmp users, all mappings, all stations, keep the service enabled
(show configuration snapshot snmp)

Try with:

aaa authentication snmp local
user snmpv2user password 111222333 read-only all no auth
user snmpv3user password abcd1234 md5+des read-write all
snmp community map "testpublic" user "snmpv2user" on
snmp security authentication set

That should allow you to query the switch by v2 (readonly) with community "testpublic" and read/write with v3 with User sbmpv3user and the password abcd1234

This is a snippet that always works in the past for me.

Do you see any hints in the logfiles of the switch? higherd the verbose for snmp?

[mayyola]

linux part
[root@Flow-166 ~]# snmpwalk -v 2c -c testpublic xx.xx.166.254
Timeout: No Response from xx.xx.166.254


[root@Flow-166 ~]# snmpwalk -v3 -u testpublic -l auth -a MD5 -A abcd1234 -x DES -X abcd1234 x.x.166.254 (is the intrusction right?)
snmpwalk: Timeout

i dont know use what the way to see the logfiles of the switch,sorry..

os6850-24x part
-> show user
User name = admin,
Password expiration = None,
Read Only for domains = None,
Read/Write for domains = All ,
Snmp allowed = NO
User name = default (*),
Password expiration = None,
Read Only for domains = None,
Read/Write for domains = None,
Snmp allowed = NO,
(*)Note:
The default user is not an active user account.
It constains the default user account settings,
for new user accounts.

User name = snmpv2user,
Password expiration = None,
Read Only for domains = All ,
Read/Write for domains = None,
Snmp allowed = YES,
Snmp authentication = NONE,
Snmp encryption = NONE
User name = snmpv3user,
Password expiration = None,
Read Only for domains = None,
Read/Write for domains = All ,
Snmp allowed = YES,
Snmp authentication = MD5,
Snmp encryption = DES

-> show configuration snapshot snmp
! SNMP :
snmp security authentication set
snmp community map "testpublic" user "snmpv2user" on


-> show system
System:
Description: 6.2.1.321.R01 GA, January 12, 2007.,
Object ID: 1.3.6.1.4.1.6486.800.1.1.2.1.7.1.3,
Up Time: 1 days 12 hours 7 minutes and 48 seconds,
Contact: Alcatel Internetworking, www.alcatel.com/enterprise/en,
Name: vxTarget,
Location: Unknown,
Services: 72,
Date & Time: MON SEP 02 2019 21:30:03 (LOCAL)

is need to update firmware, the new firmware is need to pay or free , how to find them

if i update firmware,the old configuration will disappear or not ?

[devnull]

Ok you firmware is ancient. Normally you get that from your businesspartner. Otherwise use google you may find some (shady) site supplying this.
For a firmware that old you can NOT update to latest (6.4.xx?) in one step, you need several updates in between. Config SHOULD survive, but some commands may have changed.
You probably also need fpga/Uboot/miniboot updates

I remember Support hat a documented update path, but the switches are end of support and i don't have the documents or firmware.

Some release notes (quick google) state minimum files here:
https://support.alcadis.nl/downloads/al ... ndex_get=0

I have no idea what is wrong, but debugging a 12 Year old firmware release on a device that is end of life for more than 7 years.. i can't help you here.
The commands did work in the past for than current firmware, (snmpv3 user for query needs to be snmpv3user NOT testpublic -> snmpv3 querys user not communitys)

But i can't help you here.

[mayyola]

hello,devnull:

i see the show qos log ,and when i use the instruction: snmpwalk -v 2c -c testpublic xx.xx.166.254 , it's no any log record,can you teach me any way to

see other log to check why centos can't get snmp data.

i use the old firmware function is ok so far except the snmp function,if no necessary to update , i want to move it, because it's a big thing for me

i'm not familiar for the OS6850 config

thx..

[devnull]

qos log is for qos policys with logging enabled

show log swlog shows you (on a reasonable new software) the logs of the device.