RME and devices behind firewalls.

[john.sobrinho]

We are having some problems trying to backup configs from devices located behind firewalls. Ciscoworks is able to gather information from the device (i.e. get, get reply). We are source NATing the Ciscoworks server, the configuration backup is generated through an SNMP set command that has the source address embedded in the packet payload. When the firewall receives the packet from the router destined to the CW2K server it is dropped as there is no translation (as it should be).

We are going to test a double nat as a solution, but would like to know of other possible work arounds.

[rmushtaq]

Are the devices NATted?. RME 3.4 and later supports NAT per: http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/cw2000/cw2000e/e_3_x/3_4/u_guide/ug_nat.htm

[john.sobrinho]

Natting is being performed by the firewall.

[john.sobrinho]

We tried this out to no avail, but am wondering :

- does any of the services need to be recycled

- we tried using the natted IP address as well as the address of the CW2K box.

Is there any other things we should be looking at ?

Thanks in advance...

[rmushtaq]

Are the tcp/udp ports used by CW2K open in the firewall?

[john.sobrinho]

udp 161 / 162 / 69 are open

tcp 23

Is there something we are missing ?

[rmushtaq]

http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/cw2000/cw2000_d/comser22/ig_solcv/instl.htm#1018862 has the list.

[john.sobrinho]

what's the absolute minimum required ?