Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

SNMP walks from other host

Howdy Folks, How do i limit SNMP queries from other host outside of the host needed for management? the security team is kicking my butt on this one. Help

Cisco 9513 v3.2 and 9506s

all the best,

4 REPLIES
Cisco Employee

Re: SNMP walks from other host

If the SNMP queries are sent via UDP, you can create an access list to deny UDP from any host, then permit TCP from any host. Once created, apply this access list to inbound packtes on the mgmt 0 interface. FM and DM use SNMP over TCP to access the MDS, as well as sometimes they use telnet or SSH under the covers to obtain info from the MDS CLI.

Here is a quick example:

pod4-9222i-98(config)# ip access-list nosnmp deny udp any any

pod4-9222i-98(config)# ip access-list nosnmp permit tcp any any

pod4-9222i-98(config)# int mgmt 0

pod4-9222i-98(config-if)# ip access-group nosnmp in

With this access list in place, you will not be able to use TFTP to load files...only FTP or SFTP.

Hope this helps,

Mike

New Member

Re: SNMP walks from other host

Thanks Mike,

the second i followed this list I lost SNMP to DM. In addition, I'm using mgmt software ecc and emc smarts and they listening on ports 161.

M

Cisco Employee

Re: SNMP walks from other host

Hmmm...I thought that as of 3.x all SNMP for FM and DM used TCP. Not sure about ECC. If you put in an access list to only permit SNMP from certain hosts, that would prevent SNMP from any host not in the list. The problem there is that only the hosts in the list can use FM/DM to manage the MDS. You could work with your security guys and come up with the desired access list to limit which hosts can access the MDS via SNMP.

Access list on the mgmt 0 interface is the only way I know of to lock down the MDS for SNMP queries.

Thanks,

Mike

New Member

Re: SNMP walks from other host

Thanks Mike ! I'll give it a try today.

185
Views
0
Helpful
4
Replies