cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
5638
Views
0
Helpful
3
Replies

How to disable SNMP on a Specific Interface?

In the context of an ISR4431, how do I disable SNMP access on a specific interface?

 

I have an ISR4431 at my Internet edge - ISP is plugged into one of the Gi interfaces, and I want to disable/block udp/161 access to that interface from Internet traffic.

1 Accepted Solution

Accepted Solutions

Rob Ingram
VIP Expert VIP Expert
VIP Expert

Hi, An ACL applied to snmp should give you what you want. Just permit access from the internal SNMP server(s). Example:

ip access-list standard ACL_SNMP
permit host 192.168.10.5
deny any log

snmp-server group SNMP_GRP v3 auth
snmp-server user SNMPUSER SNMP_GRP v3 auth sha PASSWORD priv aes 256 PASSWORD access ACL_SNMP

View solution in original post

3 Replies 3

Rob Ingram
VIP Expert VIP Expert
VIP Expert

Hi, An ACL applied to snmp should give you what you want. Just permit access from the internal SNMP server(s). Example:

ip access-list standard ACL_SNMP
permit host 192.168.10.5
deny any log

snmp-server group SNMP_GRP v3 auth
snmp-server user SNMPUSER SNMP_GRP v3 auth sha PASSWORD priv aes 256 PASSWORD access ACL_SNMP

Alternatively, if you put an ACL on the actual interface facing your provider and allow only what you want to allow and block all else, which would include port 161 (which is probably a slighty more impractical option than just dping an ACL on snmp)

Please remember to rate useful posts, by clicking on the stars below.

So, I do have an SNMP ACL, but a recent vulnerability test indicates that udp/161 is open on our edge routers.

 

I'm not so much afraid of someone getting "in" via that, as my SNMP ACL is suitably restrictive, but would like to just "block" that from being visible via whatever scan detected this.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers