Examkin

Question

Difficulty: HardSNMP Operations, MIBs, Traps, Informs, and Version Differences

A network administrator is deploying SNMPv3 on a Cisco IOS router to allow a central Network Management System (NMS) located at 10.20.1.10010.20.1.100 to poll interface metrics. The administrator configures a custom MIB view and applies an inbound extended Access Control List (ACL) on the router's management interface (10.20.1.110.20.1.1).

The router configuration is as follows:
text
snmp-server view IF_ONLY 1.3.6.1.2.1.2 included
snmp-server group MON_GROUP v3 priv read IF_ONLY
snmp-server user MON_USER MON_GROUP v3 auth sha Pass123 priv aes 128 Priv456
ip access-list extended MGMT_ACL
permit udp host 10.20.1.100 host 10.20.1.1 eq 162
deny ip any any
interface GigabitEthernet0/0
ip access-group MGMT_ACL in

When the NMS attempts to perform SNMP GetRequest operations to monitor interface statistics, all polling requests fail due to timeouts. Which modification will restore SNMP polling functionality?

  1. Update MGMT_ACL to permit inbound UDP traffic targeted to destination port 161 on the router.Answer
  2. B
    Remove the explicit deny ip any any statement from MGMT_ACL because Cisco IOS ACLs automatically permit stateless UDP response traffic.
  3. C
    Reconfigure the NMS client to initiate polling requests over TCP port 161 to establish connection state through the interface ACL.
  4. D
    Change the MIB object identifier in the IF_ONLY view from 1.3.6.1.2.1.2 to CDP TLV subtree 1.3.6.1.4.1.9 to allow interface polling.

Answer

Update MGMT_ACL to permit inbound UDP traffic targeted to destination port 161 on the router.
SNMP uses two distinct UDP ports for operation: UDP port 161 is used by the SNMP agent (the router) to listen for requests (such as GetRequest, GetNextRequest, and SetRequest) sent by an NMS. UDP port 162 is used by an NMS or notification receiver to listen for asynchronous traps and informs sent by managed agents. Because the NMS is attempting to poll the router for interface stats, the incoming traffic targets UDP port 161. Updating the ACL to permit destination UDP port 161 allows these polling requests to reach the SNMP agent process.

Step-by-Step Solution

1
Analyze the SNMP transport port requirements for polling vs notifications.
SNMP agents listen for incoming queries (Get, GetNext, Set) on UDP port 161. SNMP management stations listen for traps and informs on UDP port 162.
The NMS is initiating GetRequest operations toward the router, meaning incoming packets arriving at the router interface will have a destination port of UDP 161.
2
Inspect the inbound interface ACL MGMT_ACL applied to GigabitEthernet0/0.
The ACL permits UDP traffic from host 10.20.1.100 to host 10.20.1.1 eq 162 and drops all other traffic with deny ip any any.
Because destination port 161 is not permitted, the router drops incoming SNMP GetRequest packets from the NMS before they reach the SNMP engine, resulting in polling timeouts.
3
Determine the necessary ACL correction.
Modifying the ACL rule to match destination UDP port 161 allows the router to receive and process the SNMPv3 requests.
Permitting UDP port 161 aligns the firewall filter with standard SNMP agent listening behavior.

Key Concept

SNMP Transport Ports and Inbound Access Control
Rate this question

Topics

SNMP Operations, MIBs, Traps, Informs, and Version Differences

More questions from this topic