0

I have a N3K-C3064PQ-10GX and here is my snmp configuration:

Community    Group / Access      context    acl_filter
_________    ______________      _______    __________
X            network-operator               ACL mapped: switch-input


IP access list switch-input
        10 permit ip 172.17.x.x/29 any
        20 deny ip any any

but when i tried to check open ports with nmap it shows snmp is open from everywhere, whats wrong? Thank yu.

1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer. – Ron Maupin Dec 16 '20 at 23:35
0

I have no nexus where i can test this on, but this similar forum post :

https://community.cisco.com/t5/switching/snmp-acl-on-nexus/td-p/3335165

Says to try including source, destination and protocol.

The Cisco docs also say to include source, destination and port/protocol see :

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/system_management/b_Cisco_Nexus_5000_Series_NX-OS_System_Management_Configuration_Guide/Cisco_Nexus_5000_Series_NX-OS_System_Management_Configuration_Guide_chapter9.html#task_D3862190751F4B1A9F5353B015A888A7

Even though these are different Nexus types, you could give it a shot.

3
  • i have many svi so i need a general way – Blackmetal Oct 26 '20 at 15:29
  • Could you maybe include your private networks that need access to the switch, then i can try to help you create a more general ACL. It might be enough to include the destination IP and eq SNMP – Martinos Oct 26 '20 at 15:33
  • 2
    @blackmetal: That's where loopback interfaces help. Use an existing one or create one, and make sure its IP address is reachable/routeable from where you want to access it (you might want to add it's address to the dynamic rotuting protocol you are running). This brings down your SNMP ACL to just a single destination IP. – Marc 'netztier' Luethi Oct 26 '20 at 17:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.