CSCvt97205 - SNMPPOLL/SNMPTRAP to remote end (site-to-site vpn) ASA interface fails on ASA 9.14.1

[Jose Anda]

Hello,

Can anyone please confirm if this bug is resolved in 9.15.1? I am running an ASA5516x -  9.15.1 and we are still not able to poll snmp from the ASA over the s2s vpn tunnel

[jont717]

I don't think it is going to be fixed the way you want it to. It's a
feature. It is by design.

[alexhunter]

This is unfortunately now by design of the software I believe. We ended up implementing the workaround/new design and it does work, it just means you need to poll SNMP via the outside interface where your VPN peers to from, and amend the access lists at both ends to make sure the interesting traffic includes the outside addresses. This might explain it better https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvt97205

[andres.saxegaard]

The workaround will "work," but creates some other problems, and of course bloats your configs.  As of 9.18(2), it's possible to add a loopback interface, to handle the management functions through VPN, not complete yet, but it's a start.  Seems to work well on my production units.  ASDM doesn't work towards lo interface though, so if you're a gui-guy, you'll probably have to wait.