The customer configured SNMPv3 USM SHA1 with AES128 in MX router which running Junos 22.2R3-S2.8, sample configuration as below and customer password had been replaced. Observed the router sent wrong formatted packets, could not be decrypted properly.
set snmp name SOMENAME
set snmp interface fxp0.0
set snmp v3 usm local-engine user NMS authentication-md5 authentication-password Juniper@123
set snmp v3 usm local-engine user NMS privacy-aes128 privacy-password Juniper@123
set snmp v3 usm local-engine user NMS2 authentication-sha authentication-password Juniper@123
set snmp v3 usm local-engine user NMS2 privacy-aes128 privacy-password Juniper@123
set snmp v3 vacm security-to-group security-model usm security-name NMS group ALL-NMS
set snmp v3 vacm security-to-group security-model usm security-name NMS2 group ALL-NMS
set snmp v3 vacm access group ALL-NMS default-context-prefix security-model usm security-level privacy read-view GLOBAL
set snmp v3 vacm access group ALL-NMS default-context-prefix security-model usm security-level privacy notify-view GLOBAL
set snmp v3 target-address SERVER1 address 10.1.1.10
set snmp v3 target-address SERVER1 tag-list NMSNOC
set snmp v3 target-address SERVER1 target-parameters TRAP-PROFILE1
set snmp v3 target-address SERVER2 address 10.1.2.10
set snmp v3 target-address SERVER2 tag-list NMSNOC
set snmp v3 target-address SERVER2 target-parameters TRAP-PROFILE1
set snmp v3 target-address SERVER3 address 10.1.3.10
set snmp v3 target-address SERVER3 tag-list NMSNOC
set snmp v3 target-address SERVER3 target-parameters TRAP-PROFILE2
set snmp v3 target-parameters TRAP-PROFILE1 parameters message-processing-model v3
set snmp v3 target-parameters TRAP-PROFILE1 parameters security-model usm
set snmp v3 target-parameters TRAP-PROFILE1 parameters security-level privacy
set snmp v3 target-parameters TRAP-PROFILE1 parameters security-name NMS
set snmp v3 target-parameters TRAP-PROFILE2 parameters message-processing-model v3
set snmp v3 target-parameters TRAP-PROFILE2 parameters security-model usm
set snmp v3 target-parameters TRAP-PROFILE2 parameters security-level privacy
set snmp v3 target-parameters TRAP-PROFILE2 parameters security-name NMS2
set snmp v3 notify N1 type trap
set snmp v3 notify N1 tag NMSNOC
set snmp v3 snmp-community comm1 community-name Juniper@123
set snmp v3 snmp-community comm1 security-name v2comm1
set snmp engine-id use-mac-address
set snmp view GLOBAL oid iso include
Capture the packets with Wireshark, decoded with correct user name and password. Observed following messages (for the packet sent from router to server):
msgAuthenticationParameters: 3e12b7cabfb8bd139629fbe3
[Authentication: Failed calculated = f8 b9 f4 4d e1 48 d8 79 64 a5 84 3e]
Decrypted data not formatted as expected, wrong key?
[Expert Info (Warning/Malformed): Decrypted data not formatted as expected, wrong key?]
[Decrypted data not formatted as expected, wrong key?]
[Severity level: Warning]
[Group: Malformed]
SNMP traceoptions showed Error with OID : usmStatsWrongDigests.0
Sep 25 15:00:27.938631 snmpd[0] >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Sep 25 15:00:27.938645 snmpd[0] >>> Report-PDU
Sep 25 15:00:27.938658 snmpd[0] >>> Source: 10.104.8.221
Sep 25 15:00:27.938670 snmpd[0] >>> Destination: 10.219.39.101
Sep 25 15:00:27.938681 snmpd[0] >>> Version: SNMPv3
Sep 25 15:00:27.938692 snmpd[0] >>> Security Parameters:
Sep 25 15:00:27.938703 snmpd[0] >>> SecModel: USM
Sep 25 15:00:27.938718 snmpd[0] >>> EngId: 80 00 0a 4c 03 20 d8 0b b1 b2 fe
Sep 25 15:00:27.938729 snmpd[0] >>> User: NMS2
Sep 25 15:00:27.938746 snmpd[0] >>> EngBoots: 1 EngTime: 2432435
Sep 25 15:00:27.938758 snmpd[0] >>> Error: status=0 / vb_index=0
Sep 25 15:00:27.938791 snmpd[0] >>> OID : usmStatsWrongDigests.0
Sep 25 15:00:27.938803 snmpd[0] >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Recover the issue by reconfigure the snmp v3:
delete snmp v3 usm local-engine user NMS2
commit