Cisco 7604 Configuration Guide - Page 514

SNMP Inspection Chapter 22 Applying Application Layer Protocol Inspection Enabling and Configuring SNMP Application Inspection To change the default configuration for SNMP inspection, perform the following steps: Step 1 Step 2 Step 3 Determine the ports that network devices behind the FWSM listen to for SNMP traffic. The default ports are TCP ports 161 and 162. Create a class map or modify an existing class map to identify SNMP traffic. Use the class-map command to do so, as follows: hostname(config)# class-map class_map_name hostname(config-cmap)# where class_map_name is the name of the traffic class. When you enter the class-map command, the CLI enters class map configuration mode. Use a match command to identify traffic sent to the SNMP ports you determined in Step 1. If you need to assign a range of contiguous ports, use the range keyword, as in the following example: hostname(config-cmap)# match port tcp range begin_port_number end_port_number where begin_port_number is the lowest port in the range of SNMP ports and end_port_number is the highest port. Tip To identify two or more non-contiguous ports, enter the access-list extended command and define an ACE to match each port. Then, rather than the match port command, use the match access-list command to associate the access list with the SNMP traffic class. Step 4 Step 5 Step 6 Step 7 Create an SNMP map that will contain the parameters of SNMP inspection. Use the snmp-map command to do so, as follows: hostname(config-cmap)# snmp-map map_name hostname(config-snmp-map)# where map_name is the name of the SNMP map. The CLI enters SNMP map configuration mode. Specify the versions of SNMP permitted by the SNMP map. To do so, use the deny version command to disallow the versions that you do not want to permit, as follows: hostname(config-snmp-map)# deny version version hostname(config-snmp-map)# where version with an SNMP version that you want to restrict. Valid values of version are 1, 2, 2c, and 3. You can enter as many deny version commands as needed. Create a policy map or modify an existing policy map that you want to use to apply the SNMP inspection engine to the SNMP traffic. To do so, use the policy-map command, as follows: hostname(config-cmap)# policy-map policy_map_name hostname(config-pmap)# where policy_map_name is the name of the policy map. The CLI enters the policy map configuration mode and the prompt changes accordingly. Specify the class map, created in Step 2, that identifies the SNMP traffic. Use the class command to do so, as follows: hostname(config-pmap)# class class_map_name hostname(config-pmap-c)# 22-98 Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM OL-20748-01