Windows Firewall rule configuration

Have you made user that you created an exception for UDP port 161?  Make sure that you don't put in TCP or it can keep the UDP traffic from coming through.  When it comes to the status, you have to make sure that you are allowing ICMP traffic into the firewall.  Make sure you have rules that allow ICMP in and out.

Regards,

Matthew Harvey

Loop1Systems

http://www.loop1systems.com

This might sound dump, but where do you check for the ICMP settings in Windows Firewall? I am having the same problem with SNMP not working on a Windows 2008 R2 target. When I turn OFF the Public Firewall, SNMP works fine. I would like it to work with Public Firewall turned ON. Thanks in advance.

I don't believe the Windows firewall block ICMP traffic by default.  This would be something that you have to specifically restrict on a network firewall or setup a custom rule to block. 

Thanks for getting back quickly. Can you offer some help on my SNMP issue? Highly appreciate it. This is happening to a few Windows Servers only. Others seem fine. I compared the two sets and can't find any difference.

You need to create a custom rule in the inbound advanced rules for Windows Firewall. The custom rule must include "All Programs" and under the protocol select ICMPv4 and under Customize select "Echo Request". This should allow the SNMP settings to work properly. Also check to ensure that the UDP ports both 161 and 162 are enabled and the scope includes "Any subnet".

Along with what ">jschlotzhauersaid below, you'll also want to look into the SNMP service properties on those servers.  Under security, if the SNMP service is set to only receive from specific devices, make sure the NPM server IP is listed.

jschlotzhauer, thanks for the detailed steps. Changing the "Any subnet" setting for the UDP port 161 rule fixed the issue. What Orion functionality will I lose if I don't add the custom rule for ICMP? I thought SNMP will provide me all the info/updates needed.

The custom ICMP rule is basically just a "ping" request that asks for the echo details of that particular node. If my understanding is correct the custom rule provides the packet information for that node (i.e. response time, packet loss percentage, etc)

If ICMP is blocked to a server, if you do not add rules to allow it, Orion NPM will not attempt to collect SNMP data from the server or it's interfaces or volumes.  NPM must be able to successfully ping the server using ICMP before it will attempt further data collection with SNMP.

Thanks for all the great inputs. I have it all working now although I did not setup the ICMP rule yet.

mharvey, I will test your advise on a test box about setting up an ICMP rule for a Windows Node.