Access lists on the PIX are in bound to the interface only.
Therefore the DMZ_INCOMMING access-list is blocking the traffic from the dmz
back to the PIX so sending info from the pix to the server should not be
affected by access-lists
I think you need to add the interface name to the SNMP-SERVER HOST line as I
believe that the PIX will send trap information out of its most secure
interface ie to the trusted network.
Something like
snmp-server host dmz 192.168.156.208 community XXX interface DMZ
you'll need to look up the syntax
HTH
Andy
-----Original Message-----
From: Jonathan Upperman [mailto:jupperman@lubasif.com]
Sent: 26 July 2005 19:12
To: firewalls@securityfocus.com
Subject: PIX DMZ INT - SNMP MONITORING
Hello-
PIX 515 - 3 interfaces: inside, outside, dmz
I have a server (192.168.156.208) off the DMZ interface (192.168.156.1)
that runs an snmp based bandwidth grapher called 'cacti'.
Here is the snmp config on the pix:
snmp-server host dmz 192.168.156.208 community XXX
snmp-server location whatever
snmp-server contact whoever
snmp-server community XXX
snmp-server enable traps all
I have an access list on the DMZ interface (for some other traffic to
get from the dmz to the inside)
This is what I have in relation to snmp: (trying to make it work right
now)
access-list DMZ_INCOMING extended permit udp any any eq snmp
access-group DMZ_INCOMING in interface dmz
The server also has a static mapping: (to allow outside traffic in)
static (dmz,outside) 68.96.156.208 192.168.156.208 netmask
255.255.255.255
From the server if I run # snmpwalk -c <STRING> 192.168.156.1 - it
times out
ANY HELP IS APPRECIATED...
Thanks-
Jonathan
smime.p7s
Description: S/MIME cryptographic signature
