Weird problem w/ Netscreen

bleearg13

Is anyone out there monitoring Netscreens w/ ScreenOS version 5.3.0 installed? I'm having a bizarre problem where I cannot get Orion to see the device through SNMP. I've verified that the community is correct on both sides and that the interface is enabled for SNMP management.

I installed an evaluation version of the Solarwinds Toolset on the Orion server and can perform a MIB Walk and view the system MIB through the MIB Viewer without fail. I'm using the same IP and community name in both the MIB tools and Orion, but Orion fails to see the Netscreen through SNMP. I am also able to use other tools to monitor the firewall, such as Cacti/RRDTool. Ethereal traces show the SNMP requests leaving my Orion box, but not coming back. A 'debug snmp process' on the Netscreen shows that the packets are coming and pass the processing:

## 13:16:01 : Connection from 192.168.250.30 addr_string
sess_process_packet->pre-parse PASS
sess_process_packet: use snmp_parse(length 46)

Any ideas? Known bug between Netscreen/Orion? :-/


EDIT: After posting, I noticed that the NetScreen is not returning the response to Orion, although it does with other SNMPget functions:

## 13:19:58 : snmp_udp_send->53 bytes from 73C102B to 192.168.250.30 on fd 68

CCrew

I'm monitoring 19 Netscreens with no issues, three of which are 5.3.0r1. Do you have a route in the NS's routing table for the Orion box? Since the SMNP is a management function, it's the same as hitting the admin interface where if the NS is in Route/Nat mode you need an explicit route for the management (Orion) station. Ping and SNMP also has to be enabled on the untrust interface; that's supposing that you're monitoring it from the untrust side of course.

If you can hit the WebUI on the NS box from the Orion server the route table should be correct.

-R