SNMP aged out

[NiteshS]

Dear Guys,

I have a WAN router where we are trying to do a SNMP read only, but it keeps saying aged out. 

we have different devices as well which are working but SNMP on this router doesnt seem to be working.

How can i prove that it is not the issue with Palo alto but on the remote side .

The Service provider is telling us that we are sending the reply back but its not being allowed through our firewall.

[BPry]

@NiteshS,

Does the Palo Alto sit in front of the WAN router within your design; most wouldn't even have this traffic passing through the WAN router as that would sit in-front of the firewall. 

If the WAN Router traffic is getting filtered by the firewall, then do this. 

You can override the interzone default policy and enable log-start and log-end; this will allow you to log everything even if the firewall isn't allow it. Give it a bit so that the router in question is polled again and look in the logs for the polling address. This will tell you if it's allowing the traffic or not. 

[NiteshS]

Hi

RTR  --> FIREWALL-->SERVER.

We have a PAT for your SNMP Server to getting the polling for the same.

[BPry]

@NiteshS,

At that point I would log the interzone-default rule and see if the firewall is logging it as aged_out (likely a permissions or routing issue) or if the firewall is dropping or denying it for some reason.