topic Re: SNMP response on two interfaces? Possible? in General Topics

SNMP response on two interfaces? Possible?

TonyDeHart — Thu, 27 Jul 2023 20:10:54 GMT

I'm configuring NetFlow on our PA-5200. I'm collecting the data in What's Up Gold. WUG has a limitations (it appears) that the NetFlow IP that I use for the IP address also has to be respond via SNMP on the same address. However, the PA-5200 cannot send NetFlow traffic out its MGMT interface so I'm using our inside trusted interface to send Netflow traffic.

Can I configure our inside network interface IP to respond to SNMP queries while leaving the SNMP working on the MGMT interface?

I don't want to change the SNMP interface/IP used in our Service Route config because we already have other devices talking to that interface and I don't want to have to reconfigure other SNMP tools. I'm hoping this is possible.

Re: SNMP response on two interfaces? Possible?

JayGolf — Mon, 31 Jul 2023 18:39:25 GMT

Hi @TonyDeHart ,

You can configure your inside network interface IP on the PA-5200 to respond to SNMP queries while leaving SNMP working on the MGMT interface. Arte you needing assistance setting up SNMP on the inside interface?

Re: SNMP response on two interfaces? Possible?

TonyDeHart — Mon, 31 Jul 2023 19:12:08 GMT

Apparently I do need assistance. I had a ticket open with Palo because I thought I needed to do something with service routes but that is for SNMP traps only I'm told. It isn't clear to me (other than some rule) why I can't get SNMP queries to work on the inside Ethernet1/17 interface. I didn't see the query hitting the traffic monitor so I'm not sure what is happening yet or if some rule is necessary.

Essentially I need Netflow and SNMP queries on the same Ethernet1/17 interface IP.

Re: SNMP response on two interfaces? Possible?

TonyDeHart — Thu, 03 Aug 2023 13:44:56 GMT

Either there is something unique to my situation or I'm missing something. I did open a ticket with Palo on this but spent some time on it and it is still a mystery why SNMP queries to the IP on interface Ethernet1/17 are not working. I can see ingress traffic to that IP from the machine making the query but there are never any return packets and packet captures likewise show the get request but no response. Hopefully support will have an answer and if so I'll post it here.

Re: SNMP response on two interfaces? Possible?

John_Babbitt — Fri, 03 Nov 2023 22:39:15 GMT

Has anyone found a solution to your problem? On mine, snmp works through the management interface. However, I don't want to use the management interface. Rather, I want to use it on the LAN interface.

I have ping, snmp, ssh and ssl enabled on my LAN interface via interface management under Network Profiles within Interfaces. I also have SNMP enabled from Device, Setup, Operations, SNMP Setup. And, I made the appropriate policy to accommodate that. While I can SSH into it and do an ARP lookup, it wouldn't work through a MIB Browser. It says SNMP not responding. Why does it work on management interface but not on LAN interface? I can get to my web GUI from LAN interface. Just not for SNMP queries. I'm hoping you got that resolved. Thanks!

Re: SNMP response on two interfaces? Possible?

TonyDeHart — Mon, 06 Nov 2023 21:02:49 GMT

To the best of my recollection, all I was missing was the enablement of the SNMP using the management profile on our inside trusted interface. I don't remember having to change anything after that to get it to work. Do you see it in the logs now that it is on the inside? (it plainly shows in my traffic logs once using the inside interface vs the mgmt interface)