Tassos Chatzithomaoglou wrote: > > The debug shows that the snmp packet is received by the SNMP process, > although it's dropped afterwards: > > May 3 19:53:45.341: SNMP: Packet received via UDP from x.x.x.x on > FastEthernet0 > May 3 19:55:29: %SEC-6-IPACCESSLOGS: list 99 denied x.x.x.x 1 packet > > > I believe the acl check could be done first, before it even touches the > snmp process.
I think that could be quite complicated in the fully general case. The SNMP server would have to merge the ACLs for *all* the community strings, and those ACLs could have conflicting permit/deny statements so you'd have to merge e.g. all the permits and append a "deny any" and *then* re-apply the original ACL after you'd decoded the community string. Much simpler is to use CoPP or ACLs for router interface addresses at the border. This is best practice anyway. _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
