09-08-2008 04:41 PM - edited 03-11-2019 06:41 AM
Somehow my FWSM is reporting SNMP requests blocked by an ACL, despite the ACL on the interface having only the two rules that permit all IP and all ICMP. Anyone encounter this before or know what's up?
Sample logged message from an SNMP request:
%FWSM-3-710003: UDP access denied by ACL from 155.155.155.155/2468 to outside:177.177.177.177/snmp
Addresses anonymized to protect the innocent.
09-08-2008 06:24 PM
this could be related to nat..
"Some other protocols have problems with NAT. For example, SNMP network management generally does not work through a NAT point, because SNMP tools retrieve the IP addresses of devices. Since the format of the payload bearing the IP addresses is rather complex, no NAT device that I know of attempts to fix up the payload addresses. I know of a company that tried to develop code to handle this, and found it difficult..........."
09-08-2008 07:13 PM
Good thought. All the addresses on the system are NATted back to themselves, but having pointed SNMP at the ingress address, I didn't have the NAT bypass on its subnet. I'll have to give that a try.
09-08-2008 07:17 PM
Nope. No love.
09-09-2008 03:00 AM
Make "no access-group your_ACL in outside" and put it back.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: