topic Re: Firepower SNMP VPN in Network Security

Firepower SNMP VPN

opengiltd — Fri, 21 Feb 2020 17:33:35 GMT

i have recently deployed a site to site between a Firepower FTD and a ASA which is up and working but im unable to monitor the FTD using SNMP over the VPN. i have enabled access via the platform settings however it seems im only able to get stats if i use the external IP address of the firewall. This is not an option as it would be sending all SNMP traffic over the internet and not down the tunnel. I know in the traditional ASA config you would apply the management-access command which would make inbound VPN connections terminate on an interface of your choosing. I thought about trying to apply a flex config with the management-access statement but im unsure if this would work.

has anyone else been able to deploy SNMP successfully to an FTD without using the FMC or the outside VPN address?

Re: Firepower SNMP VPN

Rob Ingram — Sat, 05 Oct 2019 15:00:33 GMT

Hi,
I seem to recall having to use the "management-access" command with Flexconfig in a previous deployment, this worked ok. FYI, I also remember it would not work if you were using a BVI on the inside.

HTH

Re: Firepower SNMP VPN

hoffa2000 — Mon, 07 Oct 2019 07:29:48 GMT

I'd like to second that statement. I have my monitoring centralized watching sites over VPN and adding management-access using FlexConfig allowed me to monitor the FTDs on one of the data interfaces behind the VPNs.

Regards

Fredrik

Re: Firepower SNMP VPN

sskillin — Fri, 17 Apr 2020 21:32:34 GMT

Would you mind sharing the exact commands used in order to get SNMP working over a VPN tunnel?

Thanks!

Re: Firepower SNMP VPN

czellers — Fri, 07 Jan 2022 17:46:58 GMT

Im not seeing this documented in any of the configuration guides, is there a link or doc that outlines this process/configuration or is a TAC case the only way?

Re: Firepower SNMP VPN

czellers — Fri, 07 Jan 2022 17:48:12 GMT

What guide/docs did you leverage to build the flexconfig parameters?