Error: OID not increasing when parsing SNMP output of Checkpoint VSX

Written by Claudio Kuenzler - 0 comments

Published on July 15th 2022 - Listed in Linux Security Monitoring

While debugging the status of VPN tunnels configured in a Checkpoint VSX firewall, the SNMP output was cut short:

nagios@monitoring:~$ snmpwalk -v 3 -l authNoPriv -u nagios -a sha1 -A secret -x DES -X secret -n vsid3 checkpointfw 1.3.6.1.4.1.2620.500.9003
iso.3.6.1.4.1.2620.500.9003.1.2.3.120.166.19.0 = STRING: "Gateway_AWS_Remote_Online_2"
iso.3.6.1.4.1.2620.500.9003.1.2.3.68.31.71.0 = STRING: "Gateway_AWS_Remote_Online_1"
Error: OID not increasing: iso.3.6.1.4.1.2620.500.9003.1.2.3.120.166.19.0
 >= iso.3.6.1.4.1.2620.500.9003.1.2.3.68.31.71.0

Note: Yes, I'm still using SHA1 here. SNMP authentication with SHA1 protocol needed to be enabled as a workaround on the Checkpoint firewall. Another workaround would be to manually patch the Perl Net::SNMP module to enable newer SHA protocols.

The reason for the OID not increasing error is a sanity check inside snmpwalk. From the man page:

Some agents (LaserJets are an example) return OIDs out of order, but can complete the walk anyway. Other agents return OIDs that are out of order and can cause snmpwalk to loop indefinitely. By default, snmpwalk tries to detect this behavior and warns you when it hits an agent acting illegally. Use -Cc to turn off this check. 

By appending -Cc to the snmpwalk command, the SNMP output is indeed complete:

nagios@monitoring:~$ snmpwalk -Cc -v 3 -l authNoPriv -u nagios -a sha1 -A secret -x DES -X secret -n vsid3 checkpointfw 1.3.6.1.4.1.2620.500.9003
iso.3.6.1.4.1.2620.500.9003.1.2.3.120.166.19.0 = STRING: "Gateway_AWS_Remote_Online_2"
iso.3.6.1.4.1.2620.500.9003.1.2.3.68.31.71.0 = STRING: "Gateway_AWS_Remote_Online_1"
iso.3.6.1.4.1.2620.500.9003.1.2.3.124.76.131.0 = STRING: "Gateway_AWS_Remote_Stage_2"
iso.3.6.1.4.1.2620.500.9003.1.2.3.121.55.141.0 = STRING: "Gateway_AWS_Remote_Stage_1"
iso.3.6.1.4.1.2620.500.9003.1.3.3.120.166.19.0 = Gauge32: 3
iso.3.6.1.4.1.2620.500.9003.1.3.3.68.31.71.0 = Gauge32: 3
iso.3.6.1.4.1.2620.500.9003.1.3.3.124.76.131.0 = Gauge32: 131
iso.3.6.1.4.1.2620.500.9003.1.3.3.121.55.141.0 = Gauge32: 131
iso.3.6.1.4.1.2620.500.9003.1.4.3.120.166.19.0 = STRING: "VPN_Community_AWS_Remote_Online"
iso.3.6.1.4.1.2620.500.9003.1.4.3.68.31.71.0 = STRING: "VPN_Community_AWS_Remote_Online"
iso.3.6.1.4.1.2620.500.9003.1.4.3.124.76.131.0 = STRING: "VPN_Community_AWS_Remote_Stage"
iso.3.6.1.4.1.2620.500.9003.1.4.3.121.55.141.0 = STRING: "VPN_Community_AWS_Remote_Stage"
iso.3.6.1.4.1.2620.500.9003.1.5.3.120.166.19.0 = IpAddress: 0.0.0.0
iso.3.6.1.4.1.2620.500.9003.1.5.3.68.31.71.0 = IpAddress: 0.0.0.0
iso.3.6.1.4.1.2620.500.9003.1.5.3.124.76.131.0 = IpAddress: 0.0.0.0
iso.3.6.1.4.1.2620.500.9003.1.5.3.121.55.141.0 = IpAddress: 0.0.0.0
iso.3.6.1.4.1.2620.500.9003.1.6.3.120.166.19.0 = ""
iso.3.6.1.4.1.2620.500.9003.1.6.3.68.31.71.0 = ""
iso.3.6.1.4.1.2620.500.9003.1.6.3.124.76.131.0 = ""
iso.3.6.1.4.1.2620.500.9003.1.6.3.121.55.141.0 = ""
iso.3.6.1.4.1.2620.500.9003.1.7.3.120.166.19.0 = IpAddress: XXX.XXX.XXX.XXX
iso.3.6.1.4.1.2620.500.9003.1.7.3.68.31.71.0 = IpAddress: XXX.XXX.XXX.XXX
iso.3.6.1.4.1.2620.500.9003.1.7.3.124.76.131.0 = IpAddress: XXX.XXX.XXX.XXX
iso.3.6.1.4.1.2620.500.9003.1.7.3.121.55.141.0 = IpAddress: XXX.XXX.XXX.XXX
iso.3.6.1.4.1.2620.500.9003.1.8.3.120.166.19.0 = Gauge32: 0
iso.3.6.1.4.1.2620.500.9003.1.8.3.68.31.71.0 = Gauge32: 0
iso.3.6.1.4.1.2620.500.9003.1.8.3.124.76.131.0 = Gauge32: 0
iso.3.6.1.4.1.2620.500.9003.1.8.3.121.55.141.0 = Gauge32: 0
iso.3.6.1.4.1.2620.500.9003.1.9.3.120.166.19.0 = Gauge32: 0
iso.3.6.1.4.1.2620.500.9003.1.9.3.68.31.71.0 = Gauge32: 0
iso.3.6.1.4.1.2620.500.9003.1.9.3.124.76.131.0 = Gauge32: 0
iso.3.6.1.4.1.2620.500.9003.1.9.3.121.55.141.0 = Gauge32: 0
iso.3.6.1.4.1.2620.500.9003.1.10.3.120.166.19.0 = Gauge32: 1
iso.3.6.1.4.1.2620.500.9003.1.10.3.68.31.71.0 = Gauge32: 1
iso.3.6.1.4.1.2620.500.9003.1.10.3.124.76.131.0 = Gauge32: 1
iso.3.6.1.4.1.2620.500.9003.1.10.3.121.55.141.0 = Gauge32: 1
iso.3.6.1.4.1.2620.500.9003.1.11.3.120.166.19.0 = Gauge32: 2
iso.3.6.1.4.1.2620.500.9003.1.11.3.68.31.71.0 = Gauge32: 2
iso.3.6.1.4.1.2620.500.9003.1.11.3.124.76.131.0 = Gauge32: 2
iso.3.6.1.4.1.2620.500.9003.1.11.3.121.55.141.0 = Gauge32: 2
iso.3.6.1.4.1.2620.500.9003.1.12.3.120.166.19.0 = Gauge32: 0
iso.3.6.1.4.1.2620.500.9003.1.12.3.68.31.71.0 = Gauge32: 0
iso.3.6.1.4.1.2620.500.9003.1.12.3.124.76.131.0 = Gauge32: 0
iso.3.6.1.4.1.2620.500.9003.1.12.3.121.55.141.0 = Gauge32: 0
iso.3.6.1.4.1.2620.500.9003.1.13.3.120.166.19.0 = ""
iso.3.6.1.4.1.2620.500.9003.1.13.3.68.31.71.0 = ""
iso.3.6.1.4.1.2620.500.9003.1.13.3.124.76.131.0 = ""
iso.3.6.1.4.1.2620.500.9003.1.13.3.121.55.141.0 = ""

Add a comment

Comments (newest first)

No comments yet.