SNMP packets deny

Answered Question
Feb 18th, 2008
User Badges:
  • Silver, 250 points or more

Hello all!


I'm wondering if there is any other possibility that ACL to drop SNMP traffic on an interface (something like passive mode in OSPF which ignore packets).

I've tried to find it but no success until now.Maybe the ACL is the only one, but I said it is better to ask.

Thank you and have a nice day!


Br,

Calin

Correct Answer by Joe Clarke about 9 years 3 months ago

Depending on your IOS version, you could use control plane policing to drop SNMP packets bound for the device. This would not affect packet switching, and would not hinder performance like an interface ACL. Here is an example:


access-list 113 deny udp 10.1.1.1 any eq 161

access-list 113 permit udp any any eq 161

access-list 114 deny ip any any


class-map match-all matchsnmp

match access-group 113


policy-map dropsnmp

class matchsnmp

drop


control-plane

service-policy input dropsnmp


This would allow SNMP from 10.1.1.1, but deny it from any other host. Other traffic bound for this device would be permitted.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
Joe Clarke Mon, 02/18/2008 - 07:11
User Badges:
  • Cisco Employee,
  • Hall of Fame,

    Founding Member

Depending on your IOS version, you could use control plane policing to drop SNMP packets bound for the device. This would not affect packet switching, and would not hinder performance like an interface ACL. Here is an example:


access-list 113 deny udp 10.1.1.1 any eq 161

access-list 113 permit udp any any eq 161

access-list 114 deny ip any any


class-map match-all matchsnmp

match access-group 113


policy-map dropsnmp

class matchsnmp

drop


control-plane

service-policy input dropsnmp


This would allow SNMP from 10.1.1.1, but deny it from any other host. Other traffic bound for this device would be permitted.

Actions

This Discussion