Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Entirely open firewall still blocking SNMP

Somehow my FWSM is reporting SNMP requests blocked by an ACL, despite the ACL on the interface having only the two rules that permit all IP and all ICMP. Anyone encounter this before or know what's up?

Sample logged message from an SNMP request:

%FWSM-3-710003: UDP access denied by ACL from 155.155.155.155/2468 to outside:177.177.177.177/snmp

Addresses anonymized to protect the innocent.

4 REPLIES
New Member

Re: Entirely open firewall still blocking SNMP

this could be related to nat..

"Some other protocols have problems with NAT. For example, SNMP network management generally does not work through a NAT point, because SNMP tools retrieve the IP addresses of devices. Since the format of the payload bearing the IP addresses is rather complex, no NAT device that I know of attempts to fix up the payload addresses. I know of a company that tried to develop code to handle this, and found it difficult..........."

http://www.netcraftsmen.net/welcher/papers/pix03.html

New Member

Re: Entirely open firewall still blocking SNMP

Good thought. All the addresses on the system are NATted back to themselves, but having pointed SNMP at the ingress address, I didn't have the NAT bypass on its subnet. I'll have to give that a try.

New Member

Re: Entirely open firewall still blocking SNMP

Nope. No love.

New Member

Re: Entirely open firewall still blocking SNMP

Make "no access-group your_ACL in outside" and put it back.

518
Views
0
Helpful
4
Replies