topic Re: blocking snmp v1 & 2c but allow snmp version 3 on ASA in Network Security

blocking snmp v1 & 2c but allow snmp version 3 on ASA

cisco24x7 — Mon, 11 Mar 2019 12:26:07 GMT

I have a customer, due to cost saving, recently migrated from

a checkpoint NGx firewall over to Cisco ASA 5510

firewall with 8.0(3).

There is a Linux host on the internal network that supports

snmp version 1, 2c and 3. I want host Linux_internal to querry

host SNMP_Server with snmp version 1 or 2c; however, Linux_vendors

has to use snmp version 3 to querry the SNMP_Server host because

they are going across the Internet and that I want the snmp

traffic to be encrypted.

I want to know how it can be done with ASA5510. Prior to the

migration over to the ASA5510, I used Checkpoint firewall

integrated SmartDefense to make this work.

Is it possible with ASA to block access snmp version 1 and 2c

over the Internet and allow only snmp version 3?

Thanks.

pengfang — Thu, 03 Apr 2008 19:02:07 GMT

Yes,you can do this by "SNMP Inspection". The software later than 7.01 can support the feature,I wrote an example as followed:

access-list snmp-acl permit udp any any eq 161

access-list snmp-acl permit udp any any eq 162

class-map snmp-port

--> match access-list snmp-acl

snmp-map inbound_snmp

--> deny version 1

--> deny version 2

policy-map inbound_policy

--> class snmp-port

------> inspect snmp inbound_snmp

service-policy inbound_policy interface outside

Verify:

show service-policy inspect snmp

Of course you can use default "global_policy" which applies to all interfaces.

Hope it helps.

cisco24x7 — Fri, 04 Apr 2008 12:52:13 GMT

thanks. I will give it a try today.

One more question. Can ASA have the ability

to block ssh verison 1 through, NOT to, the

firewall with the same scenario?

pengfang — Fri, 04 Apr 2008 16:51:36 GMT

I don't think you can do that.ASA only supports very limited Application Layer Protocol Inspection, SSH is not in the list.