SNMP walks from other host

Question

Howdy Folks, How do i limit SNMP queries from other host outside of the host needed for management? the security team is kicking my butt on this one. Help
Cisco 9513 v3.2 and 9506s
all the best,

Answer 1

If the SNMP queries are sent via UDP, you can create an access list to deny UDP from any host, then permit TCP from any host. Once created, apply this access list to inbound packtes on the mgmt 0 interface. FM and DM use SNMP over TCP to access the MDS, as well as sometimes they use telnet or SSH under the covers to obtain info from the MDS CLI.
Here is a quick example:
pod4-9222i-98(config)# ip access-list nosnmp deny udp any any
pod4-9222i-98(config)# ip access-list nosnmp permit tcp any any
pod4-9222i-98(config)# int mgmt 0
pod4-9222i-98(config-if)# ip access-group nosnmp in
With this access list in place, you will not be able to use TFTP to load files...only FTP or SFTP.
Hope this helps,
Mike