Enable SNMP traps for ACLs using Cisco IOS?

Question

Does anyone know if it's possible to enable SNMP traps to be sent from a Cisco IOS device when an ACL blocks traffic? I'd like to send a trap whenever a deny statement gets a hit.

I've only been able to find information about sending ACL logs to a remote syslog server.

Thanks!

Answer 1

Sorry for submitting this as an answer, but I am new around and cannot comment, still.

Something I can think of is to do the following - I assume you want those logs to go to a Syslog server and when you receive a custom notification for that drop/deny of a specific ACL, to trigger some event - alarm, notification, email, etc.

My proposal is to add this to the end of your ACl - "deny ip X Y log", as this will generate a log record showing what has been denied by your ACL.

This should do the trick, you should be able to see logs with the name of the ACL, followed by protocol and source -> destination. Make sure you have logging enabled to level 6 - Informational, in order to see the messages generated.

Hope this helps.

Answer 2

So long as the IOS version supports it, you can use extended ACLs to allow the traffic.

Assuming the management IP of the Cisco device is 10.10.10.10 and the trap destination is 20.20.20.20...

Configure SNMP: [Reference]

snmp-server host 20.20.20.20 traps version *version* *community-string*
snmp-server enable traps global configuration

Allow traps through ACL: [Reference]

access-list *access-list-number*
  permit udp 10.10.10.10 255.255.255.255 20.20.20.20 255.255.255.255 162

Then assign that access list to the management interface:

interface *interface*
  ip access-group *access-list-number* in