- Silver, 250 points or more
I'm wondering if there is any other possibility that ACL to drop SNMP traffic on an interface (something like passive mode in OSPF which ignore packets).
I've tried to find it but no success until now.Maybe the ACL is the only one, but I said it is better to ask.
Thank you and have a nice day!
Depending on your IOS version, you could use control plane policing to drop SNMP packets bound for the device. This would not affect packet switching, and would not hinder performance like an interface ACL. Here is an example:
access-list 113 deny udp 10.1.1.1 any eq 161
access-list 113 permit udp any any eq 161
access-list 114 deny ip any any
class-map match-all matchsnmp
match access-group 113
service-policy input dropsnmp
This would allow SNMP from 10.1.1.1, but deny it from any other host. Other traffic bound for this device would be permitted.