opnsense / opnsense/plugins

Config sync transfers the listen IP of net-snmp yield into not running service on the backup node

Open
#5,479 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
PHP
Stars
1.2k
Forks
863
Avg merge
2d 6h
Merged PRs (30d)
10

Description

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

Describe the bug

In order to make net-smnp listening, you need to specify an IP address (e.g. 192.168.200.2). So far, so good.
If you sync the config to a second box in HA scenarios, the listening IP address is also synced, but in no cases can it be the same IP address. Net-SNMP stops working on the second box, unless the listen IP of the second box is set to its dedicated mgmt IP (e.g. 192.168.200.3) .

Before it rises a philosophical discussion: at least in the past, net-snmp only was able to run, if you put in an listen IP. Moreover from a security perspective, it is highly recommended that administrative interfaces (SSH, Webinterface, SNMP) can be limited to certain interfaces (and not just rely on firewall rules).

To Reproduce

Steps to reproduce the behavior:

  1. Install net-snmp and configure HA pair
  2. Setup net-snmp on both nodes, incl. their dedicated mgmt IPs (or monitoring IPs)
  3. Sync the config to the second node
  4. See net-snmp service on the second node isn't running anymore

Expected behavior

So far, I guess the sync does what it should do, but this is non-functional. Automatic config syncs (e.g. at night) are not possible, because SNMP stops working on the second node.

Describe alternatives you considered

Better approach may be: instead of setting an IP, you may choose an interface (e.g. MGMT) and a parser derives the native interface IP to use in the net-snmp config. I guess there are other use cases, where the mgmt IP should not be synced, but the interface (and the determination of the IP happens on the synced box locally).

Other approach: you put a second input as "backup node listen IP" and sync this field instead of the normal listen IP. If the field is empty, you sync the normal field.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No file or test is named. Start by tracing the net-snmp listen-IP setting through HA config sync using the reproduction steps, then compare how each node derives its management or monitoring address. Done means syncing the configuration no longer stops net-snmp on the backup node and the service listens on that node's appropriate address.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.