This article describes the issue of authentication failure, when trying to poll EX switches with SNMPv3.

The SNMPv3 authentication key is calculated, based on the user's password and the value of the engine ID. Initially, when SNMPv3 users are being configured, the RE which is the primary, uses its engine ID and configured password to calculate the key.

Authentication issue might occur post upgrade or reboot sometimes since there are chances that the engine-ID is changed. Even if the user has not configured the engine-ID, the device takes up the default engine-ID and generates the password based on the engine-ID and configured key.

To solve this issue we can reconfigure the engine-ID using either of the following:

1. use-default-ip-address : (Does not work on Junos OS Evolved) The engine ID suffix is generated from the default IP address.

                                       Default: use-default-ip-address

2. use-mac-address : (Does not work on Junos OS Evolved) The SNMP engine identifier is generated from the MAC address of the management interface on the router.

3. local <mac-address> : Explicit setting for the engine ID suffix, with local interface mac-address.
 

• We can follow below mentioned steps to overcome the SNMPv3 authentication issue:

Step 1:
check the already existing engine-id value using the following command
root@sw1> file show /var/db/snmp_engine.db

Step 2:
Deleting the SNMPv3 configuration 

Step 3:
Delete the snmp_engine.db file from /var/db directory
root@sw1>file delete /var/db/snmp_engine.db

Step 4: 
Configuring the new engine-ID using any of the below mentioned commands:

root@sw1# set snmp engine-id use-mac-address
[or]
root@sw1# set snmp engine-id use-default-ip-address
[or]
root@sw1# set snmp engine-id local <mac-address of local interface>

Step 5:
Once new engine-id is set, kindly compare the new engine-id value with the one collected in the first step. Make sure that the engine-id is changed.

Step 6:
Once new engine-ID value is set, re-configure the SNMPv3 configuration

• Following these steps the engine-ID will be re-configured and based on the new engine-ID and set key, password will be generated. This also works fine for VC switchover.
   
• If  above steps does not solve the issue then we can restart the SNMP protocol through the cli using the following command: