ASA inspecting\dropping SNMP Packets?

Hi Everyone,

I appear to be experiencing the issue that is mentioned here: http://support.solarwinds.com/kbase/ProblemDetail.cfm?ID=1323.

I have 10 Cisco 871w routers, connected via site to site VPN, through a ASA 5510. When I originally connected these devices to NPM, everything came up fine. However after about a day, interfaces on these devices will change into an "unknown" state. This usually happens if the router on the other end restarts.

In order to get the interfaces back I have to remove the entire device, and then re-add it.

This appears to be an ASA issue, but I am at a loss on how to fix it. From what I can tell, we are not doing packet inspection on SNMP, but the link above seems to make sense as to why it is happening.

Anyone that is using ASA and can help, I would love to know the solution, to allowing my SNMP packets through.

Thanks in advance

Find more posts tagged with

asa_5510

asa_discards

interface_unknown_state

Accepted answers

All comments

mcbridea

The KB you link offers the solution to configure the ASA to allow for high-numbered requests. I believe that will be the solution.

hutcha4113

It suggests it yes, but I don't know how to configure what it is mentioning. That is the help I am looking for, from anyone using ASA.

wbrown

I'm monitoring some devices through an FWSM, and haven't observed the symptoms you're experiencing. As for allowing high-numbered requests, I have never heard of doing such (or even the need to do so) in my years of working with PIX (since 5.2) or ASA or FWSM.

You mentioned that these are connected via site-to-site VPN. What address are the devices reporting as their management address? Is it the Internet-side address and is that address changing?

What are you seeing in your NPM events? There should be some messages relating to interfaces changes state.