I have a Cisco border router (CAT9K_IOSXE) that connects to the Internet and inside the network. Per Shodoan.io, I have hits on SNMP which are SVI IPs on the border router. So basically, anyone from the internet can snmp scan using SVI IP. I would like to block that. There is a Firewall on the inside that takes care of SNMP but my main goal is to prevent the border router from responding to SNMP scans from the Internet.
The easier solution would be ACL on the outside interface but we have a lot of servers that are doing SNMP to the outside system, which goes through the border router. ACL will complicate things as I will have to audit and maintain ACL for any new or removed server.
The second option is to block SVI IPs using SNMP on ACL and permit all else on the outside interface. The issue is we have a lot of SVIs and it also adds overhead on the outside interface.
The third option which I am not sure will work is to apply ACL on SVI (L3 Vlans, inbound) and block all SNMP. This should block SVIs from responding to SNMP requests.
The last option is what Cisco TAC suggested but did not provide a great deal of details. The config is:
(config)#snmp-server drop unknown-user
(config)#snmp-server drop report access ACL# (This ACL has IPs of legit monitoring SNMP hosts and denies all at the end)
I checked online and I am not sure if this will work. The first line seems to be blocking SNMP traffic with an unknown snmpv3 user name. The issue here is, per my research, the border router would need all user names/SNMP strings that all hosts on my inside network are using to talk to the outside system. I will then need to add all these into the border router's config. If I miss one, that legit traffic will be affected.
Is anyone more familiar with these configs and know if they will work for this case? Any other suggestions or feedback?
