SNMPv3 Authentication Failures on Edge Nodes Post-NSX 4.x Upgrade

Products

• VMware NSX

Issue/Introduction

After upgrading the NSX environment from a legacy 3.x release to NSX 4.x, inbound monitoring queries and automated infrastructure discovery scans from Network Management Systems (such as a ServiceNow MID Server) fail to authenticate against NSX Edge nodes using SNMPv3.

Environment

VMware NSX 4.x

Cause

The SNMPv3 user profile was originally created under a legacy NSX 3.x version. Following the upgrade to NSX 4.x, stricter security compliance protocols, and tighter password-complexity constraints were introduced.Attempting to change or reset the password on the existing legacy account via the GUI or CLI will not fix the issue, as the underlying database structure for that specific user remains incompatible.

Resolution

To resolve this issue, try creating a completely fresh identity within the NSX 4.x framework.

Pre-requisites :-

• Try restarting the SNMP service on the problematic NSX edge node by running below commands:

1. Login to admin user, stop and start the service.
      stop service snmp
  start service snmp
2. Check the status of the SNMP service by running the command get service snmp as admin user or /etc/init.d/vmware-snmpd status as root user.

• Validate there is no connectivity issue between the Edge Node and the SNMP target using below command :

 tcpdump -i any port 161 -nn | grep <ServiceNow_MID_Server_IP>

• Also, check for the current configuration and SNMP service status :

nsxcli -c get snmp v3-engine-id
nsxcli -c get snmp v3-users
service vmware-snmpd status

        (Below is a sample output of service while the Edge node was scanned and the SNMP-v3 user failed to authenticate)

Once above is confirmed, proceed with creating a new SNMP-v3 user :

Step 1: Create a New Profile in NSX Manager

1. Log in to NSX Manager UI → System → Profiles → Node Profiles.
2. Under SNMP polling, click Add SNMP Profile.
3. Delete the older SNMP profile from version SNMP v2c
4. Select SNMP v3, then set:

Username

Auth password

Priv password

     5. Save, then assign the profile to target nodes/edges.

Step 2: Update Your Monitoring System

1. Open your Network Management System (e.g ServiceNow MID Server) configuration.

2. Update the discovery credentials to point to the newly created username and password.

3. Re-run the infrastructure scan to verify that authentication succeeds and monitoring data is restored.

Additional Information

For details related to configuring/upgrading SNMP via NSX manager CLI, refer to: Simple Network Management Protocol (SNMP)

For details related to configuring a node profile, refer to Configure a Node Profile.