snmp orion question

[Vishnu Reddy]

Hi Guys,

I have Orion netflow server with IP address 192.168.5.68. I am trying to add a node(Internet Router IOS 12.x) from Internet to be represented in netflow for traffic monitoring. Orion server talks to the internet through ASA and to the Internet Router node which I am trying to add to Orion NTA.

I tried to apply Static NAT statements on the ASA so that Orion can talk to Internet router

static (inside,outside) 111.111.111.111 192.168.5.68 netmask 255.255.255.255

access-list outside_access_in extended permit udp any host 111.111.111.111 eq snmp

access-list outside_access_in extended permit tcp any host 111.111.111.111 eq 2055

Port 2055 is the port that is used by Orion NTA to collect netflow traffic.

Intenet router

G0/1 123.123.123.254 - connected to ASA - Outside of ASA - 123.123.123.1

G0/0 123.123.122.1 - Connected to Verizon Internet with default route 0.0.0.0 0.0.0.0 123.123.123.254 point to Verizon internet

Netflow configuration on the Internet router:

ip flow-export source GigabitEthernet0/1
ip flow-export version 5
ip flow-export destination 111.111.111.111 2055

int g0/1

ip flow ingress

ip flow egress

Please tell me whether this above configuration will work or Is there is another way to configure this problem.

Thanks in advance

[Marvin Rhoads]

That looks mostly correct.

Netflow export to Solarwinds Orion NTA is via tcp/2055 but rather udp/2055 (reference) so you need to change the second entry in your access-list to reflect that.

[Vishnu Reddy]

Thank you. I will give it a try. Also I will try to open the snmp via inspect map on ASA as well as include in the ACL as shown in the above configuration.

[Vishnu Reddy]

Thank you Marvin for your insight. I am worried that I am not able to get it working even though the above stated configuration should work as suggested by you. I am not able to get the ping and traceroute to that public router. Since ASA is in the middle this is really creating a headache for me.

My question is icmp ping/traceroute and snmp configs are mutually exclusive right? or they depend upon each other. First i need to get the ping connectivity work and then work on snmp.

I tried doing inspect icmp and icmp permit command on ASA but no results. These are such simple tasks but can't able to figure out. When I ping from ASA to that public IP i am getting packet unspecified type represented by ?????. I am stuck over here.

Help needed.

Thanks in advance.

[Marvin Rhoads]

Yes the ping/traceroute and snmp bits are mutually exclusive.

Are you trying to ping from Orion to the router? If so, please provide the output of the following command from the ASA command line:

packet-tracer input inside icmp <orion server address> 8 0 <router address>

(assuming your inside interface has the nameif "inside")

[Vishnu Reddy]

Thanks Marvin,

Sorry My bad. This is not an ASA. Its an PIX 515e. And I was able to resolve this issue by allowing the icmp permit statement before deny icmp statement and ping and traceroute from Orion server started working.

My next challenge is I am still not able to discover the internet router via snmp.

Orion server -  ------------- E1 inside ASA E0 outside --------------------------------F0/1 Internet router F0/0 -------------Verizon router for Internet

I am using the read-only community string for discovery.

Using SNMPWalk tool it just timesout without any error.

Am i doing anything wrong?

Thanks for all the help.

[Marvin Rhoads]

I couldn't find a specific reference just now, but I've always used both the SNMP RW and RO community strings when doing a discovery.

Can you try adding the RW and re-discovering?

[Vishnu Reddy]

Hi Marvin,

I will give a try by adding the RW string. I have a wireshark running on Orion server and I can see the Orion server making get requests but no responses. Clearly shows that the response is not coming back. Internet node seems to be fine. I am having doubts that should i be appling the access-list on the inside of the ASA.

I just applied the access on the outside of ASA allowing snmp and 2055 port.

I will let you know once I test this.

[Marvin Rhoads]

Do you have an access-list on the inside of the Pix?

You can use packet-tracer on Pix software as long as it's version 7.2(1) or later.

[Vishnu Reddy]

Thank you

I am using version 7.0(1)

 access-list inside_access_in extended permit udp any any eq snmp

 access-list inside_access_in extended permit udp any any eq 2055

I applied this on the inside interface. But no luck.

[Marvin Rhoads]

Without seeing the entire setup of the Pix it's hard to say if and where it might be blocking the traffic.

Is there a reason why you're using a firewall that hasn't been sold in over 6 years with software that's at least as old?

[Vishnu Reddy]

I am new to this company barely 1 month. I know it has loads  of configuration on it. We are planning to replace it with a pair of 5525s for HA. I am able to make it work for ICMP and traceroute. But SNMP is really giving me a tough time.

access-list outside_access_in extended permit udp any host a.b.c.d eq 2055
access-list outside_access_in extended permit udp any host a.b.c.d eq snmp

static (inside,outside) a.b.c.d e.f.g.h netmask 255.255.255.255

e.f.g.h = IP address of Orion server

a.b.c.d = public IP of mapped to orion server

I am using the public IP that spare but I am not sure how can i test that this public IP is functional. since it belongs to us and we have /24 mask meaning 254 public ip and i am using one of those.

[Marvin Rhoads]

The lines you shared from your outside_access_in ACL are correct.

Both access-list and NAT entries can be affected by other entries preceding them in the configuration, that's why I mentioned the larger configuration being relevant.

Aside from the SNMP, if you have Netflow configured on the router with those ACL entries, you should at least see the udp/2055 traffic hitting your Orion server. Have you looked for that? (e.g. using Wireshark) You may need to make the export source address the interface that connects to the ASA (fa0/1? you had mentioned a Gi0/1 earlier).

You could also debug snmp on the router to see if you are receiving the requests when you initiate an snmpwalk from Orion.

[Vishnu Reddy]

Hi Marvin,

Thanks for your help. I am not sure to paste 650 lines of config which may seem very time consuming to me even sanitizing the config. Is there any sort of channel you can remote into my laptop? I am occupied with some other stuff.

It is ok to  attempt to debug the snmp command on Internet router with terminal monitor?

Thanks in advance..

[Vishnu Reddy]

I have one question. we have a.b.c.d/24 public ips. The ips in use basically statically natted to our server at datacenter and DMZ. My thinking is that if the IP address which is natted can be tested by pinging it and it works. But what about the IP which is spare and want to test it by pinging and the result is request timeout since that IP is not being used. Now I nat it our our Orion server and should be able to ping that public ip from internet router.  I can't ping that public ip. How do we test before and after to make sure that we are achieving the right thing.

Since access-list is correct and that public ip is not being used.

Thanks for all the help