Re: SNMP Informs sent from snmpd do not work if firewall is enabled on the machine

It should work.

When you send your trap you do it from a random port to port 162 in the
receiver. And the receiver sends back the ack from port 162 to the same
random port used in the trap. So all your ack responses must have port 162
as source port and not a random port.

2011/6/15 Dattaram Porob <[email protected]>

> Dave,
>
> Even if we do assume that the receivers are listening on 162, the
> rules about specifying source port as 162 will not work because the
> ack for the Inform request is sent by the receiver from a random port
> again (and not 162) :(.
>
> I tested using 'MGSoft MIB Browser' and it behaves this way; not sure
> whether all SNMP receivers behave in the same fashion.
>
> Any other suggestions ?
>
> -Datta.
>
> On Tue, Jun 7, 2011 at 9:38 AM, Dattaram Porob <[email protected]>
> wrote:
> > Thanks Dave. Will check the feasibility of implementing these
> suggestions.
> >
> > On Mon, Jun 6, 2011 at 7:27 PM, Dave Shield <[email protected]>
> wrote:
> >> On 6 June 2011 14:07, Dattaram Porob <[email protected]> wrote:
> >>> Good suggestion, but then our application supports dynamic addition of
> >>> trap receivers.
> >>
> >> Do the receivers all listen on the standard port?  (i.e. 162)
> >> Are they all on particular subnets?    (e.g 10.x.y.z)
> >>
> >>
> >>>            So, we would have to modfy iptables rules also
> >>> dynamically; which does not sound like a good idea to me :(
> >>
> >> You could try using a somewhat looser firewall rule
> >> e.g.
> >>      -A INPUT -p udp --sport 162   -s 10.0.0.0/8   -j ACCEPT
> >>
> >> Or possibly a handful of such rules, if you'll have trap
> >> receivers on a number of defined subnets.
> >>
> >> If necessary, you could relax the source IP address completely,
> >> and allow UDP traffic from port 162 on *any* machine
> >>
> >>      -A INPUT -p udp --sport 162    -j ACCEPT
> >>
> >>
> >> As with much security, you're looking for a balance between
> >> locking things down, and keeping things usable!
> >>
> >> Dave
> >>
> >
>
>
> ------------------------------------------------------------------------------
> EditLive Enterprise is the world's most technically advanced content
> authoring tool. Experience the power of Track Changes, Inline Image
> Editing and ensure content is compliant with Accessibility Checking.
> http://p.sf.net/sfu/ephox-dev2dev
> _______________________________________________
> Net-snmp-users mailing list
> [email protected]
> Please see the following page to unsubscribe or change other options:
> https://lists.sourceforge.net/lists/listinfo/net-snmp-users
>



-- 

*Jordi López*

Project Leader - Engineering Department
IMAGO GROUP www.imagoscreens.com

(+ 34 93 341 21 00  Ext. 391

6 + 34 93 341 21 33

+ 34 667 18 02 37

@ [email protected]

* Odeco Electrónica S.A. Ramon Martí Alsina, 2-4-6 · 08911 Badalona (SPAIN)



Este correo electrónico puede contener información confidencial o legalmente
protegida y está exclusivamente dirigido a la persona o entidad
destinataria. Si usted no es el destinatario final o persona encargada de
recogerlo, no está autorizado a leerlo, retenerlo, modificarlo,
distribuirlo, copiarlo ni a revelar su contenido. Si ha recibido este correo
electrónico por error, le rogamos que informe al remitente y elimine de su
sistema el mensaje y el material anexo que pueda contener. Gracias por su
colaboración.

The information transmitted is intended only for the person or entity to
which it is addressed and may contain confidential and/or privileged
material. Any review, retransmission, dissemination or other use of, or
taking of any action in reliance upon, this information by persons or
entities other than the intended recipient is prohibited. If you have
received this message by mistake, please contact the sender and delete the
material from any computer or system. Thank you for your collaboration.

------------------------------------------------------------------------------
EditLive Enterprise is the world's most technically advanced content
authoring tool. Experience the power of Track Changes, Inline Image
Editing and ensure content is compliant with Accessibility Checking.
http://p.sf.net/sfu/ephox-dev2dev

_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users