cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
431
Views
0
Helpful
4
Replies

SNMP walks from other host

nfreeman44
Level 1
Level 1

Howdy Folks, How do i limit SNMP queries from other host outside of the host needed for management? the security team is kicking my butt on this one. Help

Cisco 9513 v3.2 and 9506s

all the best,

4 Replies 4

Michael Brown
Cisco Employee
Cisco Employee

If the SNMP queries are sent via UDP, you can create an access list to deny UDP from any host, then permit TCP from any host. Once created, apply this access list to inbound packtes on the mgmt 0 interface. FM and DM use SNMP over TCP to access the MDS, as well as sometimes they use telnet or SSH under the covers to obtain info from the MDS CLI.

Here is a quick example:

pod4-9222i-98(config)# ip access-list nosnmp deny udp any any

pod4-9222i-98(config)# ip access-list nosnmp permit tcp any any

pod4-9222i-98(config)# int mgmt 0

pod4-9222i-98(config-if)# ip access-group nosnmp in

With this access list in place, you will not be able to use TFTP to load files...only FTP or SFTP.

Hope this helps,

Mike

Thanks Mike,

the second i followed this list I lost SNMP to DM. In addition, I'm using mgmt software ecc and emc smarts and they listening on ports 161.

M

Hmmm...I thought that as of 3.x all SNMP for FM and DM used TCP. Not sure about ECC. If you put in an access list to only permit SNMP from certain hosts, that would prevent SNMP from any host not in the list. The problem there is that only the hosts in the list can use FM/DM to manage the MDS. You could work with your security guys and come up with the desired access list to limit which hosts can access the MDS via SNMP.

Access list on the mgmt 0 interface is the only way I know of to lock down the MDS for SNMP queries.

Thanks,

Mike

Thanks Mike ! I'll give it a try today.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: