RE: PIX DMZ INT - SNMP MONITORING

Syntax is like this in version 6.3.4, you have to tell the pix if the
host can receive traps or if it can poll the pix, in your case you need
poll not traps.

snmp-server host [<if_name>] <local_ip> [trap|poll]

Regards
Jan

-----Original Message-----
From: Jonathan Upperman [mailto:jupperman@lubasif.com] 
Sent: 26. juli 2005 20:12
To: firewalls@securityfocus.com
Subject: PIX DMZ INT - SNMP MONITORING


Hello-

PIX 515 -  3 interfaces: inside, outside, dmz

I have a server (192.168.156.208) off the DMZ interface (192.168.156.1)
that runs an snmp based bandwidth grapher called 'cacti'.

Here is the snmp config on the pix:

snmp-server host dmz 192.168.156.208 community XXX
snmp-server location whatever
snmp-server contact whoever
snmp-server community XXX
snmp-server enable traps all

I have an access list on the DMZ interface (for some other traffic to
get from the dmz to the inside)


This is what I have in relation to snmp: (trying to make it work right
now)

access-list DMZ_INCOMING extended permit udp any any eq snmp

access-group DMZ_INCOMING in interface dmz


The server also has a static mapping: (to allow outside traffic in)

static (dmz,outside) 68.96.156.208 192.168.156.208 netmask
255.255.255.255



> From the server if I run  # snmpwalk -c <STRING> 192.168.156.1   - it
times out


ANY HELP IS APPRECIATED...  




Thanks-

Jonathan