This article talks about the issue where SNMP manager is unable to access QFX5130-32CD device even though it uses correct community.

SNMP manager will not be able to access the QFX5130-32CD if all of the following conditions are met:

1. SNMP manager is reachable via non-management interfaces.
2. SNMP manager is reachable via non-default routing instance.
3. QFX5130-32CD uses client-list-name knob in the snmp configuration.

Sample configuration in QFX5130-32CD is below.

show configuration snmp 

community public {

  authorization read-only;

  routing-instance TEST {

    client-list-name test;

  }

}

routing-instance-access;

}

set policy-options prefix-list test 10.1.1.4/32;

show route 10.1.1.4/32

TEST.inet.0: 32 destinations, 32 routes (32 active, 0 holddown, 0 hidden)

+ = Active Route, - = Last Active, * = Both

0.0.0.0/0     *[OSPF/10] 6w5d 23:01:27, metric 101

          > to 10.10.10.0 via ae10.1020 <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< the route is reachable over non-management interface and non-default routing instance

When the SNMP manager tries to access the device, timeout occurs.

snmpwalk -v2c -c TEST@public 10.2.1.1 IfTable

SNMP timeout no response from the remote host

In the QFX5130-32cd we would see below log message,

SNMPD_AUTH_RESTRICTED_ADDRESS: nsa_initial_callback: request from address 10.1.1.4 not allowed

There is no fix or solution at present.

But the workaround is to use clients knob in the snmp configuration instead of client-list-name.

set snmp community public routing-instance TEST clients 10.1.1.4/32;
delete snmp community public routing-instance TEST client-list-name