Unpredictable Juniper SNMPv3 Access Error

This issue is a result of the engine-id changing. If you run into this syslog message, that is the exact definition of the problem.

Nov 6 09:44:35 MHN00416AN01 snmpd[1260]: SNMPD_ENGINE_ID_CHANGED: Warning: Local engine ID has changed. Passwords for all the users under [edit snmp v3 usm local-engine] need to be reconfigured. 

Unfortunately, I have found that this is happening for no apparent reason. The commit performed before this engine-id changed was a simple syslog-host addition that resulted in the engine-id changing. Juniper covers the engine-id option in their TechLibrary, which says the default option is to use the default IP address of the device.

After a lot of beating our heads against the desk, we have found that simply defining one with an explicit setting is the best option, as it remains consistent.

rj@MHN00416AN01# set snmp engine-id local ***.**.244.245 {master:0}[edit] rj@MHN00416AN01# commit configuration check succeeds commit complete 

Juniper also has a note for changing the engine-id that needs to be done before it will work. It effectively means once you commit a new engine-id, you must also commit another username/password.

Note: SNMPv3 authentication and encryption keys are generated based on the associated passwords and the engine ID. If you configure or change the engine ID, you must commit the new engine ID before you configure SNMPv3 users. Otherwise the keys generated from the configured passwords are based on the previous engine ID. For the engine ID, we recommend using the MAC address of the management port.

You'll need to commit new users into the configuration after the engine change. This is important because SNMPv3 users won't function if you don't do this despite what is actually said under the show snmp v3 users. So make sure you define new users.

rj@MHN00416AN01# set snmp v3 usm local-engine user username authentication-sha authentication-password PASS {master:0}[edit] rj@MHN00416AN01# set snmp v3 usm local-engine user username privacy-aes128 privacy-password PASS {master:0}[edit] rj@MHN00416AN01# commit configuration check succeeds commit complete 

---

Before the change:

rj@MHN00416AN01# run show snmp v3 Local engine ID: 80 00 0a 4c 01 ** ** f4 f5 Engine boots: 1 Engine time: 421043 seconds Max msg size: 65507 bytes Engine ID: 80 00 0a 4c 04 31 33 <...snip...> User Auth/Priv Storage Status Username sha/aes128 nonvolatile active 

After the change:

Local engine ID: 80 00 0a 4c 04 31 33 <...snip...> <---- previously Engine ID Engine boots: 1 Engine time: 421110 seconds Max msg size: 65507 bytes Engine ID: local <------ changed User Auth/Priv Storage Status Username sha/aes128 nonvolatile active 

This provides a more reliable SNMP setup that isn't prone to engine-id changes and eliminating access. Juniper does recommend that you use the use-mac-address option as opposed to the local engine-id-suffix. This option is susceptible to issues in a virtual chassis setup. If a backup routing engine takes over, the SNMP engine-id will change to the me0 interface of the new master.