8

I have a Juniper MX router that is accepting SNMP requests. Problem is I am sending UDP requests to one interface, and it is replying on another. The target IP is that which is assigned to lo0.1 but the router is replying on lo0.0. This is problematic as the IP address for lo0.0 is what is specified on an exterior firewall. Is there a way to define what interface needs to reply to the snmp requests?

7
  • Can you check if you have "default-address-selection" enabled (use 'show configuration system')? – Jordan Head Mar 31 '15 at 13:47
  • I do have that enabled. Removing that would resolve this I believe, but I'm not looking to impact anything other than SNMP ideally. – Wild Bill Mar 31 '15 at 14:00
  • Deleted my old comment, adding this one. What would have to change with the firewall in order for the return traffic to be okay on lo0.0, or is it another concern? – Jordan Head Mar 31 '15 at 15:54
  • 1
    Unfortunately, I couldn't find anything that would let you adjust the source address for normal SNMP queries (trap sources are always adjustable) while having "default-address-selection" enabled. – Jordan Head Apr 1 '15 at 18:24
  • When you say "the IP address for lo0.0 is what is specified on an exterior firewall" do you mean the lo0.0 IP is duplicated in two locations, both on your router and on an external firewall? – cpt_fink May 6 '15 at 3:19
2

Junos can't have multiple loopback interfaces in the same routing-instance, so you'll need to enable snmp in routing-instances first:

set snmp routing-instance-access

Obviously you'll also need a route inside your routing-instance that will get return traffic back to your SNMP poller.

0

Not being a JunOS expert, but in Cisco-land the snmp source-address x.x.x.x command would fix your issue. Here's the JunOS documentation I was able to locate:

Syntax
source-address address;
Hierarchy Level
[edit snmp trap-options]

http://www.juniper.net/techpubs/en_US/junos14.2/topics/reference/configuration-statement/source-address-edit-snmp.html

3
  • if I understand the problem, he is sending SNMP get or walks to one address, and receives replies from another. SNMP get!=trap; your answer talks about traps. I wonder whether this is a problem that could be solved by polling a different loopback – This May 6 '15 at 2:54
  • That was the part that confused me, how would an SNMP system (or any IP system...) respond to a request with a different source IP address and expect the conversation to complete correctly? – cpt_fink May 6 '15 at 3:07
  • 2
    So the option he has configured (default-address-selection) will take any system service (SNMP, NTP, whatever) and use the Loopback address as the source, instead of the interface. UNLESS, you specifically set source-address flags under each service, the unfortunate part is that this is supported by SNMP traps ONLY, not the gets/walks. Even pings to interfaces will have a different source address if this is enabled, so you have to be careful. If default-address-selection were removed, the interface IP would be the source (this is default). – Jordan Head May 6 '15 at 18:33
-1

The router is going to reply to the source IP address of the SNMP packet, right? I imagine that you would look in the routing table for the route to the subnet of the source packet to determine where the response goes. Normally, this would be the same interface that it received that packet on. You could always to some type of policy-based routing where you could force traffic desitned to [source address of SNMP packet] out of interface [whichever].

Hope that helps.

3
  • 4
    PBR is a bizarre way to handle an SNMP problem like this – This May 4 '15 at 8:10
  • @MikePennington It's not an SNMP problem. It's a routing problem. Right? – Ronnie Royston May 4 '15 at 15:51
  • 2
    sounds like a polling or Juno's problem to me – This May 4 '15 at 20:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.