Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Firewalls Community


ASA 5520 does not respond to SNMP

I recently replaced a pair of 5510s with 5520s going from 8.2 to 9.1. Aside from ACLs being cleaned WAY up, that's the only thing that's really changed here. The 5510s worked fine in NMS (Orion), but the 5520s will not.

SNMP in this case goes over a site to site tunnel (remote location) on an interface labeled management:

snmp-server host management community ***** 
snmp-server community *****
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
snmp-server enable traps ipsec start stop
snmp-server enable traps entity config-change fru-insert fru-remove
snmp-server enable traps remote-access session-threshold-exceeded

GigabitEthernet0/2.100   management      CONFIG

access-list CardAccessVPN extended permit ip (tunnel ACL)

NMS is on

I have the switch stack at this location ( polling just fine.

I can see this at least:

UDP outside management, idle 0:00:00, bytes 45, flags -
UDP outside management, idle 0:00:01, bytes 192, flags -
UDP outside management, idle 0:00:05, bytes 147, flags -

UDP outside management, idle 0:00:13, bytes 6724, flags -
UDP outside management, idle 0:00:21, bytes 86, flags -

Community and version match what I'm polling with on NMS - like I said, the "base" configs are the same. I cannot snmp walk the device either outside of Orion.

I've tried removing and re-adding the node in Orion, but no luck.

Everyone's tags (3)



the 'management' interface usually responds to traffic where the ASA itself is the destination (i.e. ping, SSH, etc), but can't pass any transit traffic through the ASA to or from another interface. do you have this line under 'management' interface?

no management-only



"management" in this case is really just a moniker for our management vlan(s), not the actual management interface itself.

On this network it's the firewall itself as the gateway, a 3850 switch stack, a KVM, and a Cyclades.

The switch stack responds to SNMP from just fine, but the ASA is no longer responding to them where as it used to prior to replacing hardware.

CreatePlease to create content
Content for Community-Ad
FusionCharts will render here