This article provides a work-around for correcting the error condition.

Note: We need to make below changes to allow the traffic for port 161 and to make it persistent under jmp-firewall/iptables file

Step 1: Take a backup of jmp-firewall file

[root@space-005056a9e845 ~]# ll -rth /usr/sbin/jmp-firewall
-r-xr-x---. 1 root root 18K Dec 16 2022 /usr/sbin/jmp-firewall

[root@space-005056a9e845 ~]# cp /usr/sbin/jmp-firewall /home/admin/jmp-firewall.org

Step 2 : Modify the below highlighted changes under enable firewall section.

[root@space-005056a9e845 ~]# vi /usr/sbin/jmp-firewall

enableFirewall()
{
version=$1

# base policy
`eval reset_${version}`
`eval active_${version}`
`eval base_${version}`

# do this even if not part of a cluster: includes traffic to/from self on main IP
`eval cluster_${version} $( list_nodes )`

if [ $CLUSTERON -eq 0 ]; then
`eval gui_${version}`
`eval devmgmt_${version}`
`eval parser_rules_${version}`
else

if [ ! -f /etc/node.conf ]; then
`eval nma_open_${version}`

fi
# always allow ssh access
`eval ssh_open_${version}`

fi
`eval special_node_${version}`
`eval debug_log_${version}`
`eval antiBruteForce_${version}`

#Rule sets for 161
ipruleset -A INPUT -p tcp --dport 161 -m state --state NEW,ESTABLISHED -j ACCEPT
ipruleset -A OUTPUT -p tcp --sport 161 -m state --state ESTABLISHED -j ACCEPT
ipruleset -A INPUT -p udp --dport 161 -m state --state NEW,ESTABLISHED -j ACCEPT
ipruleset -A OUTPUT -p udp --sport 161 -m state --state ESTABLISHED -j ACCEPT

}

Step 3: Restart the jmp-firewall service and verify if the rules are persistent now.

[root@space-005056a9e845 ~]# systemctl restart jmp-firewall

[root@space-005056a9e845 ~]# iptables -L -v -n | grep 161 | grep ESTABLISHED
  0   0 ACCEPT   tcp -- *   *    0.0.0.0/0      0.0.0.0/0      tcp dpt:161 state NEW,ESTABLISHED
  0   0 ACCEPT   udp -- *   *    0.0.0.0/0      0.0.0.0/0      udp dpt:161 state NEW,ESTABLISHED
  0   0 ACCEPT   tcp -- *   *    0.0.0.0/0      0.0.0.0/0      tcp spt:161 state ESTABLISHED
  0   0 ACCEPT   udp -- *   *    0.0.0.0/0      0.0.0.0/0      udp spt:161 state ESTABLISHED

Step 4: Verify if SNMPwalk is working fine for respective nodes.

[root@space-005056a9e845 ~]# snmpwalk -v 2c -c juniper123 10.x.x.x .1.3.6.1.2.1.1.2.0
SNMPv2-MIB::sysObjectID.0 = OID: NET-SNMP-MIB::netSnmpAgentOIDs.10

Step 5: Update SNMP for the node where SNMP service is showing down under opennms just by clicking on update snmp tab.

Additional Information: 

Q) Snmpwalk traffic is getting initiated via eth3 interface but telnet/nc traffic is getting initiated via eth0 interface.

JTAC: Yes, this is expected behaviour. Make sure to open a firewall rule for eth3 and eth1 interface for all JunosSpace in bidirectional mode.