SNMPv3 secLevel parameter needed

[grshea]

When trying to poll SNMPv3 devices the secLevel parameter is needed to poll successfuly.
From command line

Without secLevel
snmpwalk -v3 -a SHA1 -A RandomAuthPass -u wbfwl02aSNMP -x AES128 -X RandomPrivPass 10.99.255.114 sysName.0
Error in packet.
Reason: authorizationError (access denied to that object)

With secLevel
snmpwalk -v3 -l authPriv -a SHA1 -A RandomAuthPass-u wbfwl02aSNMP -x AES128 -X RandomPrivPass10.99.255.114 sysName.0
SNMPv2-MIB::sysName.0 = STRING: WBFWL-02a

[Mayur Pipaliya]

@grshea - would you recommend this as more of a documentation update as it is related to SNML CLI utilities and probably less likely to be SC4SNMP components or a bug?

[grshea]

Hi Mayur, SNMPv3 was not working for me and I tried debugging from the command line with the snmpwalk command. That’s when I found I needed the secLevel parameter and hence the open issue. Last week during a debug session with Ryan Faircloth, SNMPv3 discovery was working. Don’t know when or how because I didn’t make any changes to the configuration file. The secLevel parameter (noAuthNoPriv| authNoPriv|authPriv) is standard partof SNMPv3 request, so even though my configuration is currently working, I think it should be added. Other NMS have this parameter, SMARTS, Solarwinds, etc Regards Gregory Gregory Shea Sr Operations Engineer| IT - Corporate Operations West Bend Mutual Insurance Company 1900 South 18th Avenue West Bend, WI 53095 PH: 262-365-2110 | Fax: [phone] Email: ***@***.******@***.***> From: Mayur Pipaliya ***@***.***> Sent: Tuesday, September 21, 2021 11:10 AM To: splunk/splunk-connect-for-snmp ***@***.***> Cc: Shea, Gregory ***@***.***>; Mention ***@***.***> Subject: [External]Re: [splunk/splunk-connect-for-snmp] SNMPv3 secLevel parameter needed (#96) @grshea<https://github.com/grshea> - would you recommend this as more of a documentation update as it is related to SNML CLI utilities and probably less likely to be SC4SNMP components or a bug? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub<#96 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AVRVI6KQ6PI4I2WRKJV5XLDUDCU5RANCNFSM5DXCT2TQ>. Triage notifications on the go with GitHub Mobile for iOS<https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android<https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

[Olga]

Hello Gregory,

I've investigated the secLevel parameter.
Even though there's no secLevel option to configure, the secLevel is actually being set under the hood.
For creation of SNMP v3 security model the UsmUserData class from pysnmp python package is being used (https://github.com/etingof/pysnmp/blob/master/pysnmp/hlapi/v3arch/auth.py)

Inside the class, secLevel is calculated based on parameters given in config.yaml.

1. snmpwalk v3 example with authentication, but no encryption

config.yaml example:

    usernames:
      splunker:
         authProtocol: SHA
         authKey: changeme

In this case secLevel is authNoPriv.

2. snmpwalk v3 example with authentication and encryption

config.yaml example:

    usernames:
      splunker:
         authProtocol: SHA
         authKey: changeme
         privProtocol: AES
         privKey: changeme

In this case secLevel is authPriv.

3. snmpwalk v3 example without authentication and encryption

config.yaml example:

    usernames:
      splunker:

In this case secLevel is noAuthNoPriv.

Regards,
Olga