SNMP packets deny

Answered Question
Feb 18th, 2008

Hello all!

I'm wondering if there is any other possibility that ACL to drop SNMP traffic on an interface (something like passive mode in OSPF which ignore packets).

I've tried to find it but no success until now.Maybe the ACL is the only one, but I said it is better to ask.

Thank you and have a nice day!

Br,

Calin

I have this problem too.
0 votes
Correct Answer by Joe Clarke about 8 years 9 months ago

Depending on your IOS version, you could use control plane policing to drop SNMP packets bound for the device. This would not affect packet switching, and would not hinder performance like an interface ACL. Here is an example:

access-list 113 deny udp 10.1.1.1 any eq 161

access-list 113 permit udp any any eq 161

access-list 114 deny ip any any

class-map match-all matchsnmp

match access-group 113

policy-map dropsnmp

class matchsnmp

drop

control-plane

service-policy input dropsnmp

This would allow SNMP from 10.1.1.1, but deny it from any other host. Other traffic bound for this device would be permitted.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
Joe Clarke Mon, 02/18/2008 - 07:11

Depending on your IOS version, you could use control plane policing to drop SNMP packets bound for the device. This would not affect packet switching, and would not hinder performance like an interface ACL. Here is an example:

access-list 113 deny udp 10.1.1.1 any eq 161

access-list 113 permit udp any any eq 161

access-list 114 deny ip any any

class-map match-all matchsnmp

match access-group 113

policy-map dropsnmp

class matchsnmp

drop

control-plane

service-policy input dropsnmp

This would allow SNMP from 10.1.1.1, but deny it from any other host. Other traffic bound for this device would be permitted.

Actions

This Discussion