Entirely open firewall still blocking SNMP

[Samuel8rown]

Somehow my FWSM is reporting SNMP requests blocked by an ACL, despite the ACL on the interface having only the two rules that permit all IP and all ICMP. Anyone encounter this before or know what's up?

Sample logged message from an SNMP request:

%FWSM-3-710003: UDP access denied by ACL from 155.155.155.155/2468 to outside:177.177.177.177/snmp

Addresses anonymized to protect the innocent.

[ariesc_33]

this could be related to nat..

"Some other protocols have problems with NAT. For example, SNMP network management generally does not work through a NAT point, because SNMP tools retrieve the IP addresses of devices. Since the format of the payload bearing the IP addresses is rather complex, no NAT device that I know of attempts to fix up the payload addresses. I know of a company that tried to develop code to handle this, and found it difficult..........."

http://www.netcraftsmen.net/welcher/papers/pix03.html

[Samuel8rown]

Good thought. All the addresses on the system are NATted back to themselves, but having pointed SNMP at the ingress address, I didn't have the NAT bypass on its subnet. I'll have to give that a try.

[Samuel8rown]

Nope. No love.

[matej.polak]

Make "no access-group your_ACL in outside" and put it back.