ISR 4331 - Disable SNMP per port

[DKershner12]

 So I have a few routers that need to disable SNMP on the internet facing port. Is there a command to accomplish this?

 Or am I just doing an ACL?

[Joseph W. Doherty]

Might need to use an ACL, but not 100% positive.

What's the device and the IOS running on it?

BTW, a good ACL to start with, is one that blocks all traffic to the interface's IP.

[M02@rt37]

Hello @DKershner12,

Agree with @Joseph W. Doherty.

If you only want to disable SNMP on specific interfaces, using ACLs is a more granular and controlled method.

[balaji.bandi]

Agreed with ACL option - below guide help you :

https://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/20370-snmpsecurity-20370.html

[DKershner12]

 Thanks. It's been a long minute since I did an ACL and cisco descriptions are so bad

access list extended SNMP_deny

access list 110 deny udp any x.x.x.x 0.0.0.0 eq 161
access list 110 deny tcp any x.x.x.x 0.0.0.0 eq 161

permit any any

That's what I was basically thinking, where x.x.x.x is the IP of the port

[balaji.bandi]

i would all limited to required IP deny rest :

example :

ip access-list standard 10
permit 192.168.x.x

snmp-server community Mycomunity RO 10

or

snmp-server host 192.168.x.x mycommunity

[DKershner12]

 I'm not entirely sure what you are trying to do.

 All I want to do is block SNMP requests on internet facing ports from coming in. SNMP is already working internally. I just need to make sure a hacker doesn't use the latest SNMP vulnerability and enter our network through the internet facing port.

[balaji.bandi]

p access-list standard 10
permit 192.168.x.x   ---< this is your IP address of NMS Server ( so rest all denied)

snmp-server community Mycomunity RO 10

[DKershner12]

 OK. This is not about allowing SNMP through the internet facing port. RFC-1918 IPs are not routable on the internet.

 This is only trying to keep external bad actors from using SNMP to gain access from EXTERNAL networks.

 SNMP is done via the LAN not the WAN

SNMP must be blocked at the port facing the internet.

[balaji.bandi]

what i was suggested was only the IP can do the SNMP walk since we setup and ACL for SNMP

SNMP must be blocked at the port facing the internet.

if you like to do this, add ACL SNMP Block from Internet interface as example.

access-list 10 deny udp any any eq snmp

interface gig x/x

access-group 10 in

[DKershner12]

OK. Thanks. I have

ip access-list extended SNMP_deny
deny udp any any eq snmp
permit ip any any

interface GigabitEthernet0/0/0
ip access-group SNMP_deny in

[balaji.bandi]

yes in that context should be good.