How to Configure Security Policies to Allow SNMP
SNMP is a commonly used network management protocol. Functioning as the SNMP manager, the NMS sends management requests to the SNMP agent on a managed device. When detecting an exception, the managed device sends a trap to the SNMP manager. That is, both the NMS and the managed device initiate connections, as shown in Figure 7-5.
Therefore, you need to configure two security policies so that the NMS can proactively manage the device and the device can proactively send traps to the NMS.
No. |
Name |
Source Security Zone |
Destination Security Zone |
Source Address/Region |
Destination Address/Region |
Service |
Action |
|---|---|---|---|---|---|---|---|
101 |
Allow NMS manage firewall |
Trust |
Local |
10.1.1.10/24 |
10.1.1.1/24 |
snmp (UDP: 161) |
permit |
102 |
Allow firewall send trap to NMS |
Local |
Trust |
10.1.1.1/24 |
10.1.1.10/24 |
snmptrap (UDP: 162) |
permit |
103 |
Allow NMS manage switch |
Trust |
Untrust |
10.1.1.10/24 |
10.1.2.10/24 |
snmp (UDP: 161) |
permit |
104 |
Allow switch send trap to NMS |
Untrust |
Trust |
10.1.2.10/24 |
10.1.1.10/24 |
snmptrap (UDP: 162) |
permit |