topic Re: devices send snmp trap to stealthwach in Network Security

devices send snmp trap to stealthwach

dijix1990 — Thu, 16 Feb 2023 11:50:28 GMT

I noticed strange situation, I configured netflow exporter on the asa's and snmp server for SMC to get name of interfaces, and I can see that SMC sent snmp request to device >161/udp, but device response to 162/udp. Why does it happen?

flow-export destination inside 192.168.0.55 2055 flow-export template timeout-rate 1 flow-export delay flow-create 60 class-map Netflow_Monitor match any policy-map global_policy class Netflow_Monitor flow-export event-type all destination 192.168.0.55 SNMP: snmp-server host inside 192.168.0.50 community snmpCom ver 2c

Re: devices send snmp trap to stealthwach

Marius Gunnerud — Thu, 16 Feb 2023 11:57:58 GMT

UDP/161 is used for SNMP polling by default, and UDP/162 is used by the device to send unsolicited SNMP traps.

did this answer your question?

Re: devices send snmp trap to stealthwach

dijix1990 — Fri, 17 Feb 2023 02:24:40 GMT

Hi, I know it, use it in zabbix, but why ASA sends snmp trap to SMC, maybe it usual situation for connecting with SMC, because I didn't configure snmp trap, I try to understand why my CPI server can get snmp response and SMC can't, configuration the same and when I start to check session and noticed that asa send snmp trap

Re: devices send snmp trap to stealthwach

dijix1990 — Fri, 17 Feb 2023 02:42:11 GMT

I found, when you run command -

snmp-server host inside 192.168.0.50 community snmpCom ver 2c

asa does it as

snmp-server host inside 192.168.0.50 community snmpCom ver 2c udp-port 162

so, it's because of asa behavour

Re: devices send snmp trap to stealthwach

Marius Gunnerud — Fri, 17 Feb 2023 09:03:46 GMT

Well, yes. When you define an SNMP server you are essentially telling the ASA to send SNMP traps to that server. If you do not want the ASA to send any SNMP traps remove the commands for snmp-server enable traps