topic Re: Cisco PIX snmp not working in Network Security

Cisco PIX snmp not working

godzilla0 — Mon, 11 Mar 2019 14:27:53 GMT

Hi, I'm trying to get info about a PIX with snmp but it's not working, I get a timeout when I try to query it. I'm asking to the inside interface over VPN, It works fine and I see all the computers on that subnet. I think I just need an ACL but I'm not managing to do it right. The config is posted, it's pretty simple. Thanks.

Re: Cisco PIX snmp not working

John Blakley — Fri, 19 Dec 2008 15:18:36 GMT

Can you ping 192.168.3.29 from the pix? If you can, then try to allow udp 161 through your acl for just that one host.

HTH,

John

Re: Cisco PIX snmp not working

godzilla0 — Fri, 19 Dec 2008 15:28:34 GMT

No, I can't ping that host from the PIX. But I can ping from the computers on that subnet to the 192.168.3.0 net. Thanks.

Re: Cisco PIX snmp not working

Mo'ath Al Rawashdeh — Fri, 19 Dec 2008 15:42:14 GMT

Hi,

Can you do the test again, and right after, show us the output of the command below on your firewall:

show logging | inc A.B.C.D

where A.B.C.D is the IP address of the machine you are testing from.

Re: Cisco PIX snmp not working

godzilla0 — Fri, 19 Dec 2008 15:44:42 GMT

Return is null. Back to the command prompt, empty result.

Re: Cisco PIX snmp not working

John Blakley — Fri, 19 Dec 2008 17:51:40 GMT

Try changing the snmp-server line to outside.

snmp-server host outside 192.168.3.29

See if that works.

HTH,

John

Re: Cisco PIX snmp not working

ajagadee — Fri, 19 Dec 2008 17:54:35 GMT

Xavier,

If I understand the set up correctly, you are trying to do a SNMP Poll through the VPN Tunnel. If so, you need the below command:

management-access inside

http://www.cisco.com/en/US/docs/security/pix/pix63/command/reference/mr.html#wp1137951

Without the above command, you will not able to ping, https, http, snmp, etc to the inside interface of the pix across a VPN Tunnel.

Regards,

Arul

*Pls rate if it helps*

Re: Cisco PIX snmp not working

godzilla0 — Fri, 19 Dec 2008 18:02:53 GMT

Is not working . . . anyways why would I allow to send to the outside iface ? The connection is encrypted and so I ask the inside iface, right ?

Re: Cisco PIX snmp not working

godzilla0 — Fri, 19 Dec 2008 18:15:37 GMT

Ok, good ! Now I can ping, but I get a "CRITICAL" on the nagios script when I try to get the info for the iface "ethernet0". Do you have any experience around ? It works on all my other cisco routers, load balancers etc.

Re: Cisco PIX snmp not working

godzilla0 — Fri, 19 Dec 2008 18:19:43 GMT

When I do a snmpwalk to the router, It does not give me back nothing . . . Maybe I have to do something more to make snmp work =?

Re: Cisco PIX snmp not working

ajagadee — Fri, 19 Dec 2008 18:37:53 GMT

Hi,

Can you change the below configuration:

snmp-server host inside 192.168.3.29

snmp-server host outside 192.168.3.29

And let me know if it works.

Regards,

Arul

*Pls rate all helpful posts*

Re: Cisco PIX snmp not working

godzilla0 — Fri, 19 Dec 2008 18:59:48 GMT

It's done, working. The guy that said management is closed for inside interface by default was correct. I'm monitoring the inside and outside interfaces with graphing via nagios. Thank you all.

Re: Cisco PIX snmp not working

ajagadee — Fri, 19 Dec 2008 19:08:53 GMT

Thanks for the update! Also, please do update the forum that the issue is resolved, so others who run into similar issues can benefit out of the post.

Regards,

Arul

Re: Cisco PIX snmp not working

tf2-conky — Tue, 12 Jan 2010 02:13:02 GMT

This resolved the same issue I had with nagios monitoring of my ASA firewall over a VPN.