Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Djamil
New Contributor

SNMP blocked by IPv4 Policy

Hello guys,

 

I'm actually working on administrating our Fortigates and monitoring them using LibreNMS.

 

My problem is with one FortiGate that have an IPv4 Policy with the following configuration :

 

 

If I change the destination from the "Virtual IP Group LDLC-redirect-Zyxel" to "ALL", I can add this FortiGate to LibreNMS without any problem, but as soon as I put the Virtual IP Group back, I lose the SNMP pooling.

 

How can I solve this issue?

 

 

12 REPLIES 12
Djamil
New Contributor

emnoc wrote:

You don't need a fwpolicy to manage a firewall via SNMP.

 

do a "show interface wan1 | grep allowaccess"

Yes it is enabled on the firewall Interface, I can see the following line : set allowaccess ping https ssh snmp http

As I said before, the problem is not the SNMP but the IPv4 Policy.

 

emnoc wrote:

You don't need a fwpolicy to manage a firewall via SNMP.

 

The IPv4 Policy is not for SNMP, it was already in place. The FW is proprietary to our client, the policy was already in place, to describe what I found (look the attached image) :   1- They created two virtual IPs one for TCP and one for UDP 2- They created one Virtual IP Group with the two Virtual IPs 3 - They created the IPV4 Policy shown previously

 

 

emnoc
Esteemed Contributor III

We would need to see the 2 vips to better understand but the configuration you have in place seem bad design. The IPv4 policy should have nothing todo with the monitoring of SNMPagent on the fortigate.

 

Did you run any diag debug flow ?

 

Ken Felix

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
Djamil
New Contributor

emnoc wrote:

We would need to see the 2 vips to better understand but the configuration you have in place seem bad design. The IPv4 policy should have nothing todo with the monitoring of SNMPagent on the FortiGate.

 

Did you run any diag debug flow ?

 

Ken Felix

Yes, I did # diagnose sniffer packet any 'port 161' 4 and I can see traffic coming in from my NMS server to the firewall :

interfaces=[any]
filters=[port 161]
10.520423 port1 in NMS_IP.53260 -> Firewall_WAN_IP.161: udp 45
10.520430 port2 out NMS_IP.53260 -> Firewall_WAN_IP..161: udp 45
11.521459 port1 in NMS_IP.53260 -> Firewall_WAN_IP..161: udp 45
11.521463 port2 out NMS_IP.53260 ->Firewall_WAN_IP..161: udp 45

 

Note: I replaced the actual real IPs with Firewall_WAN_IP & NMS_IP in this post for the confidentiality of my client.

 

Here is the firewall policies in place  :

 

Port1 is the WAN port

Port2 is the LAN port

 

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors