SNMP v3 polling failing when multiple SNMP profiles have the same user name

Products

• CA Network Flow Analysis (NetQos / NFA)

Issue/Introduction

NFA may fail to poll SNMPv3 devices if you have multiple SNMP profiles with the same username.

When using Wireshark to SNMP poll the device you may see a response Report with the OID  - 1.3.6.1.6.3.15.1.1.5, which means:

usmStatsWrongDigests 
 "The total number of packets received by the SNMP engine which were dropped because they didn't contain the expected digest value."

See the link below for more details on this message:

http://www.mibdepot.com/cgi-bin/getmib3.cgi?win=mib_a&i=1&n=SNMP-USER-BASED-SM-MIB&r=cisco&f=SNMP-USM-MIB-V1SMI.my&v=v1&t=sca&o=usmStatsWrongDigests

 

Environment

Release: RAIB1H99000-9.3-Network Flow Analysis-Interface Bundle-Hardware
Component:

Resolution

Delete the SNMP profiles with the duplicate user name so that there is only one profile with that username.

1. If you have just NFA go to Admin->SNMP Profiles and delete the profile from there.

2. If you have CAPC, go to Admin->Configuration Settings->SNMP Profiles and delete the profiles from there.

3. After deleting the profile force a Full Resync of the NFA Data Source from the Admin->Data Sources page of CAPC and allow some time for it it complete.

4. You can verify that the profile has been deleted by checking the snmpprofiles table on the Harvester servers databases.

In 9.3.3 and earlier use:

mysql poller
select * from snmpprofiles;

In 9.3.6 and later use:

mysql harvester
select * from snmpprofiles;

5. Once you verify the SNMP profiles have been removed from NFA, try to Rediscover and Refresh the devices again from the Admin->Enable Interfaces page of NFA.

Additional Information

To decode the SNMP reports from the device in Wireshark, you can go to Edit->Preferences->Protocols->SNMP.

Then Edit the "User Tables"  and enter the SNMPv3 username, password, Authentication model and Privacy protocol/password that you are using on this device.