If Zenoss reports 'SNMP Agent Down' but snmpwalk against the device works, you should go to zProperties for those specific devices (not for every device) and change zMaxOIDPerRequest from 40 to something lower. 20 or 10 generally works.

Cisco ASAs seem to be picky about the size of packets being sent to them sometimes.

Thanks to rmatte for answering this question in IRC