How to disable SNMP or udp port 161 on my Internet gateway router

[Mohammad Babjani]

Hi Everyone,

We have an Internet gateway router(#CiscoASR) on which we have snmp configuration for monitoring purpose and we have secured it with ACL as well. But now our infosec team is saying that they are able to see the router as vulnerable for SNMP threats when they have done a vulnerability scan from internet, though we have secured it by using ACL's. Please suggest how to fix this.

Thanks,

Babjani.

[johnd2310]

Hi,

What type of access-list are you using? Interface access-list, SNMP access-list.

Thanks

John

[Mohammad Babjani]

Hi John,

We are using only standard ACL for SNMP as of now. In case if we use can use interface ACL, if we used interface ACL and it is the entry point to our organization and it is a 1Gig link. Will their be toll on cpu ? Please let me know.

Thanks,

Babjani.

[johnd2310 · Accepted solution]

Hi,

You need to use both snmp access-list and interface access-list. The snmp access-list specifies which devices can access snmp using the specified string. Therefore, the router will process snmp and reject or accept based on access-list and string. You, therefore, will need an access-list on the outside interface to block all snmp packets from the Internet.

There should be no impact on the router from having an access-list on the outside interface as long as you do not have excessive logging enabled on the access-list.

Thanks

John

[Mohammad Babjani · Accepted solution]

Hi John/Everyone,

Thanks John for your time over this discussion.

We have applied an extended ACL over the Internet link interface deny snmp, snmptraps ntp traffic and permitting rest of the traffic. Hence the issue resolved.

Thanks,

Babjani.