topic Re: Entirely open firewall still blocking SNMP in Network Security

Entirely open firewall still blocking SNMP

Samuel8rown — Mon, 11 Mar 2019 13:41:10 GMT

Somehow my FWSM is reporting SNMP requests blocked by an ACL, despite the ACL on the interface having only the two rules that permit all IP and all ICMP. Anyone encounter this before or know what's up?

Sample logged message from an SNMP request:

%FWSM-3-710003: UDP access denied by ACL from 155.155.155.155/2468 to outside:177.177.177.177/snmp

Addresses anonymized to protect the innocent.

Re: Entirely open firewall still blocking SNMP

ariesc_33 — Tue, 09 Sep 2008 01:24:31 GMT

this could be related to nat..

"Some other protocols have problems with NAT. For example, SNMP network management generally does not work through a NAT point, because SNMP tools retrieve the IP addresses of devices. Since the format of the payload bearing the IP addresses is rather complex, no NAT device that I know of attempts to fix up the payload addresses. I know of a company that tried to develop code to handle this, and found it difficult..........."

http://www.netcraftsmen.net/welcher/papers/pix03.html

Re: Entirely open firewall still blocking SNMP

Samuel8rown — Tue, 09 Sep 2008 02:13:41 GMT

Good thought. All the addresses on the system are NATted back to themselves, but having pointed SNMP at the ingress address, I didn't have the NAT bypass on its subnet. I'll have to give that a try.

Re: Entirely open firewall still blocking SNMP

Samuel8rown — Tue, 09 Sep 2008 02:17:57 GMT

Nope. No love.

Re: Entirely open firewall still blocking SNMP

matej.polak — Tue, 09 Sep 2008 10:00:47 GMT

Make "no access-group your_ACL in outside" and put it back.