cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
828
Views
0
Helpful
4
Replies

Entirely open firewall still blocking SNMP

Samuel8rown
Level 1
Level 1

Somehow my FWSM is reporting SNMP requests blocked by an ACL, despite the ACL on the interface having only the two rules that permit all IP and all ICMP. Anyone encounter this before or know what's up?

Sample logged message from an SNMP request:

%FWSM-3-710003: UDP access denied by ACL from 155.155.155.155/2468 to outside:177.177.177.177/snmp

Addresses anonymized to protect the innocent.

4 Replies 4

ariesc_33
Level 1
Level 1

this could be related to nat..

"Some other protocols have problems with NAT. For example, SNMP network management generally does not work through a NAT point, because SNMP tools retrieve the IP addresses of devices. Since the format of the payload bearing the IP addresses is rather complex, no NAT device that I know of attempts to fix up the payload addresses. I know of a company that tried to develop code to handle this, and found it difficult..........."

http://www.netcraftsmen.net/welcher/papers/pix03.html

Good thought. All the addresses on the system are NATted back to themselves, but having pointed SNMP at the ingress address, I didn't have the NAT bypass on its subnet. I'll have to give that a try.

Nope. No love.

matej.polak
Level 1
Level 1

Make "no access-group your_ACL in outside" and put it back.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: