topic Re: SNMP aged out in General Topics

SNMP aged out

NiteshS — Mon, 07 May 2018 16:57:13 GMT

Dear Guys,

I have a WAN router where we are trying to do a SNMP read only, but it keeps saying aged out.

we have different devices as well which are working but SNMP on this router doesnt seem to be working.

How can i prove that it is not the issue with Palo alto but on the remote side .

The Service provider is telling us that we are sending the reply back but its not being allowed through our firewall.

Re: SNMP aged out

BPry — Mon, 07 May 2018 17:07:06 GMT

@NiteshS,

Does the Palo Alto sit in front of the WAN router within your design; most wouldn't even have this traffic passing through the WAN router as that would sit in-front of the firewall.

If the WAN Router traffic is getting filtered by the firewall, then do this.

You can override the interzone default policy and enable log-start and log-end; this will allow you to log everything even if the firewall isn't allow it. Give it a bit so that the router in question is polled again and look in the logs for the polling address. This will tell you if it's allowing the traffic or not.

Re: SNMP aged out

NiteshS — Mon, 07 May 2018 17:26:27 GMT

RTR --> FIREWALL-->SERVER.

We have a PAT for your SNMP Server to getting the polling for the same.

Re: SNMP aged out

BPry — Mon, 07 May 2018 17:40:02 GMT

@NiteshS,

At that point I would log the interzone-default rule and see if the firewall is logging it as aged_out (likely a permissions or routing issue) or if the firewall is dropping or denying it for some reason.