IP SLA port

Question

Hi,
Just a quick clarification. We use IP SLA product with a router configured as the SA agent(with ip sla monitor responder enabled) and use our SNMP Management station (Concord) to measure/take the stats from the routers and display accordingly. However, all the SA Agents (Customer CPE) have now moved behind a 3rd party maintained firewall. I need to open up this firewall but am unsure of the direction of the traffic flow.
So, I think it uses UDP Port 1967 but can you tell me if the SNMP Concorde Station polls the SA Agents/Customer CPE with UDP port 167 as destination?
dunshaughlin_PE14_dub>sh ip sockets
Proto Remote Port Local Port In Out Stat TTY OutputIF
17 0.0.0.0 0 10.88.79.225 1967 0 0 211 0
17 255.255.255.255 0 10.80.103.84 2067 0 0 100001 0
17 10.196.126.39 162 10.80.103.84 50646 0 0 0 0

Answer 1

Back again, I've just been onto the Concorde support people.
They have come back to me confirming that there concorde server can communicate via Port 161 to both the SAA Source and SAA Destination. The SAA Destination where the Responder command is enabled(10.80.103.105) can ping the SAA Source(10.80.100.54). However, Concorde are insisting that I need to confirm that the SAA source and SAA Destionation SLA app are communicating with each other.
I can successfully ping between each other but the ACL 111 I have enabled on both ends is not picking anything up even though Concorde is setup to poll every 62 seconds? My access-list 111 which I am debugging is
SAA_Responder_dub#sh access-list 111
Extended IP access list 111
10 permit icmp host 10.80.100.54 host 10.88.163.225
20 permit icmp host 10.80.100.54 host 10.80.103.105
30 permit ip host 10.80.100.54 host 10.80.103.105
40 permit ip host 10.80.100.54 host 10.88.163.225
SAA_Responder_dub#
Any ideas or should I raise a TAC?