After going over the existing documentation it appears that it is supported but not implemented, allow me to expand.
The TRAP jnxSecAccessIfMacLimitExceeded falls under Port Security Features, hence the
be under the
secure-access-port stanza, and as per documentation, these actions differ from the
interface-mac-limit packet-action; they don't generate an SNMP trap:
Why supported? My approach would be first to check if there is support for the specific trap you are intending to use, as this might not always be true.
For this you can use Junipers MIB Explorer.
From the MIB Explorer by looking up that TRAP on the Junos version you have we see the following hierarchy:
iso > org > dod > internet > private > enterprises > juniperMIB > jnxMibs > jnxExMibRoot > jnxExSwitching > jnxExSecureAccessPort >
The takeaways here are that this is an Enterprise level MIB(as standard MIBs also exist), the jnxExSecureAccessPortMIB and your intended TRAP, which in this case is supported.
Although there is an Juniper Enterprise MIB, heading to the MIB explorer is perhaps more straightforward.
Next step would be to check for that MIB being registered with the snmpd, currently we lack of that information from your end.
On Monitoring SNMP Activity and Tracking Problems That Affect SNMP Performance on a Device Running Junos OS > Checking for MIB Objects Registered with the snmpd
For the SNMP process to be able to access data related to a MIB object, the MIB object must be registered with the snmpd.
You can use the following commands to check for MIB objects that are registered with the snmpd:
`show snmp registered-objects`—Creates a /var/log/snmp_reg_objs file that contains the list of registered objects and their mapping to various subagents.
`file show /var/log/snmp_reg_objs`—Displays the contents of the /var/log/snmp_reg_objs file.
The same information is contained in KB17695:
To test TRAPS you can follow steps below:
From request snmp spoof-trap
You can test the trap:
user@host> request snmp spoof-trap jnxSecAccessIfMacLimitExceeded
You can also check for available traps:
user@host> request snmp spoof-trap ?
Regarding the lack of snmp information on your log/messages, see information below:
From the Monitoring SNMP Activity and Tracking Problems That Affect SNMP Performance on a Device Running Junos OS
On: Tracking SNMP Activity
By default, Junos OS does not trace any SNMP activity. To enable tracking of SNMP activities on a device running Junos OS, include the traceoptions statement at the [edit snmp] hierarchy level.
A sample traceoptions configuration might look like below. Flagging all could be process intensive so keep an eye on cpu stats:
set traceoptions flag all;
You can always reach Juniper Forums, which I see you have done already (based on username from both sites):
Recomendations given on the Forum:
- You can configure "set snmp traceoptions flag pdu" and check /var/log/snmpd to see if jnxSecAccessIfMacLimitExceed traps are getting generated.
- Check with the latest JTAC recommended release if you have the liberty to: https://kb.juniper.net/InfoCenter/index?page=content&id=kb21476
- remove the category hierarchy altogether and try the trace
- Engage JTAC