pfSense » pfSense Packages

NET-SNMP generates an incorrect trapsess configuration for SNMPv3 trap destinations.
For an SNMPv3 trap destination configured with security level priv, pfSense generates:
trapsess -v 3 -I priv -u snmpv3user x.x.x.x 162

The Net-SNMP documentation defines -I as an input parsing option, while -l is used to specify the SNMPv3 security level.
According to the Net-SNMP documentation:
-I - specifies input parsing options
-l - sets the security level used for SNMPv3 messages

As a result, the SNMPv3 trap destination is not created correctly and no SNMPv3 trap packets are transmitted.

Steps to reproduce:
1. Configure NET-SNMP
2. Under Trap Generation, configure SNMPv2 trap sink and SNMPv3 trap sink
3. Save
4. Start a packet capture on the outgoing interface for UDP port 162.
5. Restart the NET-SNMP service to generate a notification.

Result
The SNMPv2 trap is transmitted, but no SNMPv3 trap is present in the packet capture.
The generated SNMPv3 entry is:
trapsess -v 3 -I priv -u snmpv3user <destination> 162

If manually modify /var/etc/netsnmpd.conf and changing only -I to -l
trapsess -v 3 -l priv -u snmpv3user <destination> 162

After restarting the service, both SNMPv2c and SNMPv3 traps will be presented in the packet capture.