5

Does anyone know if it's possible to enable SNMP traps to be sent from a Cisco IOS device when an ACL blocks traffic? I'd like to send a trap whenever a deny statement gets a hit.

I've only been able to find information about sending ACL logs to a remote syslog server.

Thanks!

2
  • I made a minor edit for clarification. At first, I misread the question as "How do I allow SNMP traps from a device's ACL". Feel free to roll-back if I decreased readability.
    – Ryan Foley
    Feb 4, 2015 at 13:44
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Dec 31, 2020 at 21:02

2 Answers 2

1

Sorry for submitting this as an answer, but I am new around and cannot comment, still.

Something I can think of is to do the following - I assume you want those logs to go to a Syslog server and when you receive a custom notification for that drop/deny of a specific ACL, to trigger some event - alarm, notification, email, etc.

My proposal is to add this to the end of your ACl - "deny ip X Y log", as this will generate a log record showing what has been denied by your ACL.

This should do the trick, you should be able to see logs with the name of the ACL, followed by protocol and source -> destination. Make sure you have logging enabled to level 6 - Informational, in order to see the messages generated.

Hope this helps.

-1

So long as the IOS version supports it, you can use extended ACLs to allow the traffic.

Assuming the management IP of the Cisco device is 10.10.10.10 and the trap destination is 20.20.20.20...

Configure SNMP: [Reference]

snmp-server host 20.20.20.20 traps version *version* *community-string*
snmp-server enable traps global configuration

Allow traps through ACL: [Reference]

access-list *access-list-number*
  permit udp 10.10.10.10 255.255.255.255 20.20.20.20 255.255.255.255 162

Then assign that access list to the management interface:

interface *interface*
  ip access-group *access-list-number* in
2
  • Thanks! I may have been unclear - I really want the switch to send a trap when it blocks traffic due to an ACL. Is this possible?
    – James
    Feb 4, 2015 at 12:14
  • That clears it up...closest I've seen is the snmp-server enable traps firewall, but I don't think that applies to ACLs. I would see if that option is even available on your device.
    – Theo
    Feb 4, 2015 at 12:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.