We are currently using sensor (5.2.0.4) . We have configured syslog to server 1 through port 514 and snmp to server 2 through ports 161 and 162. While capturing the firewall traffic we can able to see traffic generating from the sensors to server2 (SNMP which should be port 161 and 162) through port 514.This traffic gets dropped because there is no firewall rule open for this port 514 to snmp server. But we need to fix this issue.
Steps performed as part of troubleshooting:
1. Verified the IP of the syslog and snmp server in the alert settings in the defense center are correct
2. Verified the IP in the command line \etc\sf\audit_log.conf in the sensor command line are correct
3. Verified inside the policy rules settings also.
