topic Re: Cisco ASA- Configuring snmp over the IPSEC tunnel in Network Security

Cisco ASA- Configuring snmp over the IPSEC tunnel

LovejitSingh130013 — Thu, 17 Jun 2021 18:19:24 GMT

Hello experts @balaji.bandi @Marvin Rhoads @Rob Ingram

I have ASA at site1 and it is connected via ipsec VPN with site 2. At site 2 I got snmp server (Solarwinds Orion) setup.

I cant add ASA on snmp-server for polling.

I can ping the ASA inside/management interface from Snmp-server but I cant ping the snmp-server from ASA inside interface.

If I try to connect within inside network for snmp it works fine but not over VPN.

Re: Cisco ASA- Configuring snmp over the IPSEC tunnel

Rob Ingram — Thu, 17 Jun 2021 18:41:57 GMT

@LovejitSingh130013

You'll need to have the command "management-access inside" configured, to access the inside interface over a VPN for mgmt purposes, such as snmp, ssh etc.

You cannot select a source interface for a ping on the ASA, it will always use the egress interface (probably your outside interface).

Re: Cisco ASA- Configuring snmp over the IPSEC tunnel

LovejitSingh130013 — Thu, 17 Jun 2021 19:39:09 GMT

This command is already there and i can ping the ASA inside interface from snmp server (over the ipsec). But snmp is failing on it.

These are snmp related commands I added. Do I am missing anything ?

ASA(config)# sh run | i snmp
snmp-server host inside 10.110.111.48 poll community ***** version 2c
no snmp-server location
no snmp-server contact
inspect snmp

Re: Cisco ASA- Configuring snmp over the IPSEC tunnel

Rob Ingram — Thu, 17 Jun 2021 19:47:10 GMT

@LovejitSingh130013

Ok, refer to this post and see the reply about appending the "route-lookup" command to your NAT exemption rule.

https://community.cisco.com/t5/security-documents/asa-snmp-polling-via-vpn-site-to-site-tunnel/ta-p/3154865

Re: Cisco ASA- Configuring snmp over the IPSEC tunnel

LovejitSingh130013 — Thu, 17 Jun 2021 19:56:13 GMT

It is already there.

Re: Cisco ASA- Configuring snmp over the IPSEC tunnel

Rob Ingram — Thu, 17 Jun 2021 20:02:10 GMT

Ok, run through this ASA SNMP troublshooting guide, run the different tests and provide the output of the packet-tracer and packet capture. Also provide the output of "show snmp-server statistics".

https://community.cisco.com/t5/security-documents/snmp-configuration-verification-and-troubleshooting-on-asa/ta-p/4300068

Re: Cisco ASA- Configuring snmp over the IPSEC tunnel

LovejitSingh130013 — Thu, 17 Jun 2021 20:08:17 GMT

output for sh snmp-server statistics

Groff-ASA(config)# sh snmp-server statistics
0 SNMP packets input
0 Bad SNMP version errors
0 Unknown community name
0 Illegal operation for community name supplied
0 Encoding errors
0 Number of requested variables
0 Number of altered variables
0 Get-request PDUs
0 Get-next PDUs
0 Get-bulk PDUs
0 Set-request PDUs (Not supported)
0 SNMP packets output
0 Too big errors (Maximum packet size 1500)
0 No such name errors
0 Bad values errors
0 General errors
0 Response PDUs
0 Trap PDUs

I will post the Packet captures shortly

Re: Cisco ASA- Configuring snmp over the IPSEC tunnel

LovejitSingh130013 — Thu, 17 Jun 2021 20:27:12 GMT

ASA(config)# sh capture
capture snmpv2 type raw-data interface inside [Capturing - 0 bytes]
match udp host 10.255.255.18 eq snmp host 10.110.111.48

I dont see any traffic so far.

I can poll 10.255.255.17 which is switch directly connected with ASA inside interface.

Re: Cisco ASA- Configuring snmp over the IPSEC tunnel

LovejitSingh130013 — Tue, 29 Jun 2021 15:41:16 GMT

@Rob Ingram Worked with TAC and its bug in 9.14 firmware. It is fixed in 9.15.

Thanks for your help. Config was correct.

Re: Cisco ASA- Configuring snmp over the IPSEC tunnel

johnsmunoz — Sat, 11 Dec 2021 01:50:19 GMT

Any workaround available? I'm on a ASA5555 and the latest software currently available is 9.14(3)15

Re: Cisco ASA- Configuring snmp over the IPSEC tunnel

LovejitSingh130013 — Thu, 17 Mar 2022 16:43:06 GMT

Firmware needs to be upgraded.

Re: Cisco ASA- Configuring snmp over the IPSEC tunnel

johnsmunoz — Wed, 20 Jul 2022 17:19:43 GMT

Did TAC happen to share the Bug ID with you?

Re: Cisco ASA- Configuring snmp over the IPSEC tunnel

Rob Ingram — Wed, 20 Jul 2022 17:39:47 GMT

@johnsmunoz I am guessing it's this bug https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvt97205

Re: Cisco ASA- Configuring snmp over the IPSEC tunnel

Marvin Rhoads — Wed, 07 Dec 2022 16:43:59 GMT

Besides the bugID mentioned by @Rob Ingram, this is a change of behavior introduced in ASA 9.14(2) and affects any ASA release at that version or higher. Basically you need to add the outside address of the remote ASA in the crypto map (at both ends) and then poll the remote ASA using the outside address (traffic is still protected in the IPsec VPN). Make sure you have allowed the remote NMS as an SNMP host via the outside interface.

Reference:

https://www.cisco.com/c/en/us/td/docs/security/asa/asa914/release/notes/asarn914.html#reference_xqs_mvp_xhb

Re: Cisco ASA- Configuring snmp over the IPSEC tunnel

james.mathieson — Sun, 04 Jun 2023 09:40:23 GMT

I've been having trouble getting this working as well and have just stumbled across this supposed new feature.

It seems a step backwards to me as when you set the management interface to inside, SNMP traffic did go through the VPN already, without having to add all this extra config, firewall rules and sometimes an extra route.

Maybe I've understood this all wrong but I'm sure it was done for a reason.

Re: Cisco ASA- Configuring snmp over the IPSEC tunnel

tvotna — Mon, 05 Jun 2023 14:35:28 GMT

It is believed that this is a side effect of ASA 9.14, where snmpd was implemented as an external process running outside of ASA/Lina, which is accessible via internal nlp_int_tap interface through internal NAT. This caused incompatibility. Only TAC can tell if this is going to be fixed (has been fixed?).

Re: Cisco ASA- Configuring snmp over the IPSEC tunnel

james.mathieson — Wed, 07 Jun 2023 18:30:48 GMT

Thanks for the info.

After more digging it seems it's been fixed, or more of a proper workaround in 9.18.

In 9.18 you can have loopbacks and they're compatible with SNMP etc, so that's what I'm going to do.

Cisco do make some bad decisions these days. Don't get me started on Firepower.

🙂

Re: Cisco ASA- Configuring snmp over the IPSEC tunnel

Christopher Heaton — Wed, 28 Jun 2023 23:39:05 GMT

9.18 doesn't seem to be available anymore... Cisco really did go backwards on this one. Monitoring via internal IP through a tunnel is secure and is industry standard.

Re: Cisco ASA- Configuring snmp over the IPSEC tunnel

kaghy2 — Tue, 15 Aug 2023 09:37:13 GMT

I completely agree that this is a step backwards, and after reading the bug report it seems a BIG step backwards. Seeing all the affected releases too.

Despite that, it really makes it harder to poll our devices correctly now, having to implement eg. 10 rules, instead of just 1 or 2.

Besides the issue of out --> in not being possible for another interface --> interface, not being able to SNMP is a downfall.

Re: Cisco ASA- Configuring snmp over the IPSEC tunnel

Christopher Heaton — Tue, 15 Aug 2023 14:23:04 GMT

Definitely! I think someone thought "Oh, this will be better..." It is not better and is going to lose product loyalty, especially in the smaller firewall arena.