4

Does anyone know if it's possible to enable SNMP traps to be sent from a Cisco IOS device when an ACL blocks traffic? I'd like to send a trap whenever a deny statement gets a hit.

I've only been able to find information about sending ACL logs to a remote syslog server.

Thanks!

  • I made a minor edit for clarification. At first, I misread the question as "How do I allow SNMP traps from a device's ACL". Feel free to roll-back if I decreased readability. – Ryan Foley Feb 4 '15 at 13:44
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 11 '17 at 4:12
-1

So long as the IOS version supports it, you can use extended ACLs to allow the traffic.

Assuming the management IP of the Cisco device is 10.10.10.10 and the trap destination is 20.20.20.20...

Configure SNMP: [Reference]

snmp-server host 20.20.20.20 traps version *version* *community-string*
snmp-server enable traps global configuration

Allow traps through ACL: [Reference]

access-list *access-list-number*
  permit udp 10.10.10.10 255.255.255.255 20.20.20.20 255.255.255.255 162

Then assign that access list to the management interface:

interface *interface*
  ip access-group *access-list-number* in
| improve this answer | |
  • Thanks! I may have been unclear - I really want the switch to send a trap when it blocks traffic due to an ACL. Is this possible? – James Feb 4 '15 at 12:14
  • That clears it up...closest I've seen is the snmp-server enable traps firewall, but I don't think that applies to ACLs. I would see if that option is even available on your device. – Theo Feb 4 '15 at 12:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.