topic PIX and SNMP traps? in Network Security

PIX and SNMP traps?

jason.aarons — Fri, 21 Feb 2020 07:52:44 GMT

I see in the OpenView NNM Alarm Browser that PIX firewalls are hammering NNM with snmp traps about connections (show conn). This is overloading NNM. I propose the following change to stop trapping to NNM, but allow polling only;

BCBS-Pix515# show snmp

snmp-server host inside 10.10.254.233

snmp-server enable traps

BCBS-Pix515# config t

BCBS-Pix515(config)# snmp-server host inside 10.20.254.233 poll

BCBS-Pix515(config)#

!--- The host can query but is not to be sent traps.

Reference;

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094a13.shtml

I'd still like to get traps, just not the connection entries, is there a better way?

Re: PIX and SNMP traps?

gfullage — Tue, 18 Jan 2005 22:49:18 GMT

You can turn off logging for just that particular message, something like:

no logging message 302015

no logging message 302013

should get the TCP and UDP connection syslogs. If there's another particular message that you're seeing a lot of, just add the above commands, the message number is the first number in the line. For example:

%PIX-6-302015: Built outbound UDP connection number for 10.1.1.1 to 200.1.1.1

Re: PIX and SNMP traps?

jason.aarons — Wed, 19 Jan 2005 00:41:41 GMT

I don't want to disable syslog, but rather SNMP.