DCE and SNMPv3 SHA/AES not working w/ UPS NMC

[Phlerm]

Odd issue we are seeing. StruxureWare Data Center Expert 7.9.1.83 cannot communicate with UPS Network Management Cards (v2 and v3) via SNMPv3 when using SHA/AES. NMC software versions are: (NMCv2: 7.0.8; NMCv3: 2.2.1.1). If we change the settings for SNMPv3 to MD5/DES (on the NMC and DCE), then DCE is able to successfully scan the UPS/NMC. SNMPv1 works as well. I have been unable to find a documented bug. We are able to query these devices successfully via SNMPv3 SHA/AES for trending data (Cacti).

Other devices like PDUs, IRCs and Galaxy VS UPS systems don't seem to be having any trouble.  Any ideas?

[Shaun]

Hi @Phlerm,

Can I ask:

- Was this configuration working previously?

- How & when were the cards upgraded?

- Can you recall exactly what version NMC you lost communication at?

- Has the DCE been rebooted since you lost communication?

Thanks,

  Shaun

[Phlerm]

Hi Shaun, thanks for responding,

- Configuration was working previously

- Cards were upgraded via Struxureware DCE

- Prior version of NMC3 was 2.0.0.5.  Not sure about NMC2, but it was in the 7.x train

- Yes, rebooted DCE as a troubleshooting step. 

- I have also tried removing and re-adding NMCs using SNMPv3.  The device is successfully added to DCE, but is unrecognized and labled as "SNMP Device".  Of course I can always change SNMP settings to correct this (switch to SNMPv1 or SNMPv3 w/ MD5/DES) , but it doesn't follow our security guidelines.

[Shaun]

Hi,

Just checking in so I'm not leaving you in the dark - I'm trying to reproduce this locally.  It's certainly a supported configuration that's expected to work - obviously monitoring our own network cards is most the point of the platform.

If I can't replicate the same I may ask you to get in touch with your local support so we can try to capture the network traffic and see what's missing - but I have the same software and the same cards as you, so I'm hopeful I should be able to replicate.

[Phlerm]

Appreciate the update.  I'll update this post if I come across any information that might help troubleshoot.

[Shaun]

Hi @Phlerm,

Just wanted to check one detail - if you login to the NMC on the UPS, can it still see the UPS status correctly?

Showing up as "SNMP Device" when they're re-discovered is an odd detail that may indicate they have the wrong firmware loaded (for example, PDU firmware on a UPS), and we just want to rule that out.

Thanks,

  Shaun

[Phlerm]

Yes, the card can see the UPS correctly. 

Just to clarify, a NMC will only show up as "SNMP device" if I add it w/ SNMPv3 SHA/AES.  If I then change the configuration of SNMP on the NMC and DCE to SNMPv3 MD5/DES, the card will be scanned correctly and the model etc updates as expected. 

[Phlerm]

We noticed that DCE 7.9.2 was released yesterday.  Just for good measure, we updated DCE to 7.9.2 today.  We are still seeing the issue w/ SNMPv3 using SHA/AES.

Thanks!