Allowing SNMP traffic to establish a flow through CSS

[csbowser]

One of my 'inside' customers needs to query and receive SNMP traps to systems outside the network. Inside customers have private IPs.

According to docs, the CSS (11506, ver 7.20) does not setup a flow for UDP 161/162. Therefore, the traffic won't get NAT'ed, and the traffic will die at the edge of the network.

Any suggestions on a work-around or fix for this?

[Gilles Dufour]

With version 6.10 a command called 'flow-state' was created to override this restriction.

But it does not apply to CSS 115xx.

So, unfortunately, if you have a CSS11506 there is no workaround. You have to find a way to bypass the CSS to send this traffic.

Gilles.

[seilsz]

Gilles,

Can you explain why snmp queries (udp 161) could not be configured with a source group to make this work?

In addition, would a normal udp content rule not work for the snmp traps (udp 162)?

Thanks,

Zach

[csbowser]

Zach,

This is the problem! The CSS will not build a flow for several things:

67, /* BOOTP server */

68, /* BOOTP client */

137, /* NETBIOS name service */

138, /* NETBIOS datagram service */

161, /* SNMP */

162, /* SNMP traps */

520, /* RIP */

8089,/* Inktomi UDP only */

This means it will switch the data, but not apply it to a content rule - thus no NAT'ing takes place. One guess is, that it would be too hard to try and NAT the protocols listed - plus the vulnerabilities for some would be too great.

[seilsz]

Chad,

Can you point me to where this is documented?

Thanks,

Zach

[Gilles Dufour]

You can check this document which is quite good to understand UDP traffic on the CSS

http://www.cisco.com/en/US/products/hw/contnetw/ps789/products_tech_note09186a00801e05ee.shtml

For the non-flow traffic, check the following url:

http://www.cisco.com/en/US/products/hw/contnetw/ps789/products_qanda_item09186a008009851a.shtml

Regards,

Gilles.

[seilsz]

Ok, so FCB's are created for DNS by default but not for the ports listed in the second link. However, the behavior with the ports listed in the second link can be overridden with the 'flow-state' command, but only on the 110xx series switches?

When will the 'flow-state' command be available on the 115xx series switches?

Thanks,

Zach

[Gilles Dufour]

Zach,

This command is on the roadmap for the next 11500 Webns release - so July/August.

Gilles.