Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows Server 2012 R2 SNMP problem


  • Please log in to reply
8 replies to this topic

#1 Servernooblet

Servernooblet

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:08:31 AM

Posted 18 May 2017 - 01:24 AM

Hi all!

I'm having extremely weird SNMP problem on one of our hosted Windows Server 2012 R2. More precisely it's about SNMP service. Server has SNMP service installed from roles and features and it is working fine locally, but over network it just doesn't work. Server has QlikView products installed which also use SNMP (some, not all products), but I've disabled all QlikView services and still couldn't get SNMP answer over network. Also configured QlikView products to NOT user SNMP. Here are things which I have tested:

- Windows's SNMP service is OK & running (tested locally with Paessler SNMP tester)
- Confirmed that port 161 is used for Windows's snmp.exe
- Port 161 is listening (& ofc open)
- Firewall traffic allowed for SNMP agent
- Ping is OK
- Pretty sure that SNMP packets get through, but server just doesn't answer to them
- SNMP community OK

Tried asking help from QlikView forum but it seems to me & them that this is not QlikView related problem. Hence why I'm asking help here. I'm all out of new fresh ideas. All help would be greatly appreciated!



BC AdBot (Login to Remove)

 


#2 Servernooblet

Servernooblet
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:08:31 AM

Posted 22 May 2017 - 04:50 AM

BUMP



#3 JohnnyJammer

JohnnyJammer

  • Members
  • 1,117 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:QLD Australia
  • Local time:03:31 PM

Posted 22 May 2017 - 04:55 PM

I have never bothered with SNMP  but i would be looking at IIS as i understand when installing from roles it uses IIS to listen for connections?

Check applications pool and also permissions would be my guess mate.



#4 Servernooblet

Servernooblet
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:08:31 AM

Posted 23 May 2017 - 12:01 AM

I have never bothered with SNMP  but i would be looking at IIS as i understand when installing from roles it uses IIS to listen for connections?

Check applications pool and also permissions would be my guess mate.

 

I must beg to differ, when I checked Web Server (IIS) from server roles and IIS Hostable Web Core from features, both selections were empty. Mayby the IIS role / feature is not installed with SNMP (at least so it seems).



#5 x64

x64

  • Members
  • 352 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London UK
  • Local time:06:31 AM

Posted 23 May 2017 - 10:36 AM

On the snmp service itself, in services.msc, view the service's properties  - check the security tab. There you can select to accept packets from 'any host' of from a list of specified hosts. If my memory servers me correctly, the list is the active selection and initially contains just 127.0..0.1 (i.e.localhost)

 

If that looks like it is the problem and you alter the settings, then you'll need to restart the service to pick up those changes.

 

x64



#6 Servernooblet

Servernooblet
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:08:31 AM

Posted 24 May 2017 - 12:30 AM

On the snmp service itself, in services.msc, view the service's properties  - check the security tab. There you can select to accept packets from 'any host' of from a list of specified hosts. If my memory servers me correctly, the list is the active selection and initially contains just 127.0..0.1 (i.e.localhost)

 

If that looks like it is the problem and you alter the settings, then you'll need to restart the service to pick up those changes.

 

x64

 

We have added SNMP agents IP-addresses to that list you were referring. I even tried using any host option with no effect.



#7 x64

x64

  • Members
  • 352 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London UK
  • Local time:06:31 AM

Posted 24 May 2017 - 10:47 AM

I presume that the second bullet point in your opening pose referred to verifying that 161/udp was actually bound to the snap service (with "netstat -a -b", network tab of resource monitor, tcpview or similar)?

 

Is the system in a network location where it would be relatively safe to briefly disable the server's firewall, just as a quick test? What about the other end - could the reply be being blocked there? Any significant infrastructure between the two systems?

 

Maybe remove /reboot/re-add the snmp features?

 

x64 



#8 Servernooblet

Servernooblet
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:08:31 AM

Posted 26 May 2017 - 12:04 AM

I presume that the second bullet point in your opening pose referred to verifying that 161/udp was actually bound to the snap service (with "netstat -a -b", network tab of resource monitor, tcpview or similar)?

 

Is the system in a network location where it would be relatively safe to briefly disable the server's firewall, just as a quick test? What about the other end - could the reply be being blocked there? Any significant infrastructure between the two systems?

 

Maybe remove /reboot/re-add the snmp features?

 

x64 

 

I can see from resource monitor (and output from netstat -a -B) that snmp.exe is listening on port 161. From task manager I can also see that snmp.exe is running and its source is C:\Windows\System32, so it is a Windows service.

 

The firewall is using same profile that other server in parallel IP-address. Other server works just like it should. Also, from resource monitor I can see that snmp.exes Firewall status states: "Allowed, not restricted". There is no firewall in sending snmp agent and also no blocking firewall between the problematic server and snmp agent.

 

Tried removing and re-adding Windows service (with boot), no luck.



#9 Servernooblet

Servernooblet
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:08:31 AM

Posted 29 May 2017 - 12:38 AM

Monday BUMP






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users