cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
144
Views
5
Helpful
2
Replies
Beginner

Data Plane filter SNMP traffic

Hello everyone,
Scenario:
Router 1 (Edge IP 1.1.1.1)
is connected to ISP Router 2 (IP 2.2.2.2) via BGP,
and via Tunnel to Internal Router (IP 3.3.3.3)
It´s now that transit traffic to SNMP Port 161 and 162 hits the Internal Router, means malicious traffic
(port scans / whatever).
My Question is:
How would a transit ACL for the Data Plane will look like to filter/block these attempts ? and how is it applied to the Control Plane? Or would a Interface ACL inbound to the Router 1 (Edge) to the job. Some helpful advice would be great. Thank you all.

 

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Rising star

Re: Data Plane filter SNMP traffic

Hi,

 

    It's recommended to filter that kind of traffic, inbound on your Edge router, before it hits the Internal router; this would be a regular ACL to deny traffic destined to UDP 161 and UDP 162 and allow other traffic that you want/need.

   At the same time, if you want to offer better protection to your internal router, which may be "attacked" from the inside network, additionally to what i stated above, you should configure control-plane protection on your Internal router and restrict which management protocols do you allow, and from which IP's.

 

https://tools.cisco.com/security/center/resources/copp_best_practices

 

Regards,

Cristian Matei.

View solution in original post

2 REPLIES 2
Highlighted
Rising star

Re: Data Plane filter SNMP traffic

Hi,

 

    It's recommended to filter that kind of traffic, inbound on your Edge router, before it hits the Internal router; this would be a regular ACL to deny traffic destined to UDP 161 and UDP 162 and allow other traffic that you want/need.

   At the same time, if you want to offer better protection to your internal router, which may be "attacked" from the inside network, additionally to what i stated above, you should configure control-plane protection on your Internal router and restrict which management protocols do you allow, and from which IP's.

 

https://tools.cisco.com/security/center/resources/copp_best_practices

 

Regards,

Cristian Matei.

View solution in original post

Highlighted
Beginner

Re: Data Plane filter SNMP traffic

Thank you Cristian,

that´s sound good.