topic Re: SNMP - Query inside interface from Outside in Network Security

SNMP - Query inside interface from Outside

julian — Fri, 21 Feb 2020 08:18:57 GMT

Anyone come across this one?

I have a network monitoring station in my DMZ that monitors devices at a customer site. I can see all the internal devices fine (using SNMP polling over the VPN tunnel we have created to the site).

I want to SNMP query the Pix itself, on its internal interface, but i get no response. I guess its something to do with the VPN, but I CAN ping the internal interface of the remote Pix over the VPN, so i don't know why SNMP won't work.

For obvious reasons, I do not want to enable SNMP on the Pix's external interface.

Anyone point me in the right direction on this?

Julian

Re: SNMP - Query inside interface from Outside

acrophile — Tue, 23 Aug 2005 21:00:54 GMT

I'm having the same issue.. can anyone pitch in with a fix? :).

Re: SNMP - Query inside interface from Outside

julian — Tue, 23 Aug 2005 22:56:01 GMT

Never mind : )

Fixed it, but you would not believe how i did it!

I had to create two SNMP-SERVER host's with the same IP address for BOTH the internal AND the external interfaces...

e.g.

snmp-server host outside xxx.xxx.xxx.xxx community public

snmp-server host inside xxx.xxx.xxx.xxx community public

(where xxx.xxx.xxx.xxx) is the external SNMP Trap recipient / SNMP query server).

It 'kind' of makes sense, although in a warped and twisted way... thankyou Cisco!

Julian

Re: SNMP - Query inside interface from Outside

acrophile — Wed, 24 Aug 2005 01:10:32 GMT

my problem is a little different I guess... I have two sites, each with a router & pix... the vpn is setup between the two pix's... I want to hit the inward facing interface on one router from the internal network of the other office over the vpn...

it's driving me crazy 🙂

Re: SNMP - Query inside interface from Outside

julian — Wed, 24 Aug 2005 09:43:54 GMT

If i interpret this correctly, are you saying that you want to monitor the internal interface of Router B (from the internal network) behind Pix A and Router A?

I presume that all interfaces on the Routers have public IP addresses?

Re: SNMP - Query inside interface from Outside

mostiguy — Fri, 26 Aug 2005 10:41:57 GMT

On PIXen, look at the management-access command. It is designed for you to set up a non outside interface as being accessible for remote monitoring setups.

Re: SNMP - Query inside interface from Outside

julian — Fri, 26 Aug 2005 13:52:31 GMT

Ah, but isn't he trying to monitor the router inside interface, not the Pix management interface?

Julian

Re: SNMP - Query inside interface from Outside

acrophile — Mon, 29 Aug 2005 17:29:23 GMT

correct