PCM2.1+ no longer talks with 7203dl

[Dave Costello]

My PCM+ will no longer talk with my 7203dl. It was working fine but then one day lost communication. Discovery won't find it and I can no longer manual discover it either. I get a time out error on the Connection Status screen. I've tried deleting and reentering the SNMP info in the router and in PCM but to no avail. I'm about ready to hose the router back to the original config and start over.

P.S. This thread has been moved from Switches, Hubs, Modems (Legacy ITRC forum) to Network Management > PCM. -HP Forum Moderator

[Igoris_1]

google for getif 2.3.1 snmp utility, set IP address, community and see if you get response. If yes, then PCM has a problem. Otherwise router config or network, maybe you have some firewall on the way from PCM server to the router.

[Dave Costello]

Getif connects to anything/everything on the network except the router. I can telnet to the router, http to the router but I can't access it for SNMP. Is there a way to reset everything on the router?

[Matt Hobbs]

You can just do an 'erase startup' on the 7203dl, but if you can paste your configuration here (remove any sensitive info) it may help to understand why it's not working. Possible reasons I can think of are incorrect SNMP settings, or an Access Control Policy that is limiting access.

[Dave Costello]

Here's the config for the router:

! ProCurve Secure Router 7203dl SROS version J06.06
! Boot ROM version J06.06
! Platform: ProCurve Secure Router 7203dl, part number J8753A
! Serial number US509TS041
! Flash: 33554432 bytes DRAM: 268435455 bytes
! Date/Time: Wed Apr 04 2007, 12:27:09 EDT
!
!
hostname "HPRouter"
enable password encrypted 3e374bd9caba05613640cd76173f99257e2e
!
clock timezone -5-Eastern-Time
!
ip subnet-zero
ip classless
ip domain-name "expertserver.com"
ip name-server 10.1.0.37
ip routing
!
event-history on
no logging forwarding
no logging email
logging email priority-level info
!
service password-encryption
!
username "administrator" password encrypted "444df514ede85795764c975c2ebcf4063a41"
!
ip policy-timeout tcp all-ports 1200
!
ip firewall
ip firewall stealth
ip firewall check reflexive-traffic
ip firewall check winnuke
no ip firewall alg msn
no ip firewall alg pptp
no ip firewall alg h323
no ip firewall alg sip
!
aaa on
ftp authentication LoginUseLocalUsers
!
!
aaa authentication login LoginUseTacacs group tacacs+
aaa authentication login LoginUseRadius group radius
aaa authentication login LoginUseLocalUsers local
aaa authentication login LoginUseLinePass line
!
aaa authentication enable default enable
!
no autosynch-mode
no safe-mode
!
ip crypto
!
interface eth 0/1
ip address 10.1.0.11 255.255.0.0
access-policy TRUSTED
no shutdown
!
interface eth 0/2
speed 100
no ip address
shutdown
!
interface t1 1/1
clock source internal
tdm-group 1 timeslots 1-24 speed 64
no shutdown
!
interface t1 1/2
clock source internal
shutdown
!
interface ppp 1
ip address 1.2.3.4 255.255.255.224
access-policy UNTRUSTED
no lldp send
no shutdown
bind 1 t1 1/1 1 ppp 1
!
ip access-list standard MATCHALL
remark NAT list MATCHALL
permit any
!
ip access-list extended INCITRIX
permit tcp any host 1.2.3.4 eq 1494
!
ip access-list extended INENG111
permit tcp any host 1.2.3.4 eq www
permit tcp any host 1.2.3.4 eq https
permit tcp any host 1.2.3.4 eq 902
!
ip access-list extended INENG143
permit tcp any host 1.2.3.4
!
ip access-list extended INENG52
permit tcp any host 1.2.3.4
!
ip access-list extended INENGGW1
permit tcp any host 1.2.3.4 eq www
permit tcp any host 1.2.3.4 eq https
permit tcp any host 1.2.3.4 eq telnet
permit tcp any host 1.2.3.4 eq ssh
permit tcp any host 1.2.3.4 eq 61
permit tcp any host 1.2.3.4 eq 5900
permit tcp any host 1.2.3.4 eq 5901
permit tcp any host 1.2.3.4 eq 5902
permit udp any host 1.2.3.4 eq 5900
permit udp any host 1.2.3.4 eq 5901
permit udp any host 1.2.3.4 eq 5902
!
ip access-list extended INENGTUNNEL
permit udp any host 1.2.3.4 eq 1194
!
ip access-list extended INMAIL
permit tcp any host 1.2.3.4 eq www
permit tcp any host 1.2.3.4 eq https
permit tcp any host 1.2.3.4 eq smtp
!
ip access-list extended INMERCURY
permit tcp any host 1.2.3.4 eq www
permit tcp any host 1.2.3.4 eq https
!
ip access-list extended INMX1
permit tcp any host 1.2.3.4 eq smtp
!
ip access-list extended INNS1
permit udp any host 1.2.3.4 eq domain
!
ip access-list extended INPOSTMAN
permit tcp any host 1.2.3.4 eq smtp
permit tcp any host 1.2.3.4 eq pop3
permit tcp any host 1.2.3.4 eq 1677
permit udp any host 1.2.3.4 eq 1677
!
ip access-list extended INREMOTE
permit tcp any host 1.2.3.4 eq 3389
!
ip access-list extended INROSS
permit tcp any host 1.2.3.4 eq 8105
permit udp any host 1.2.3.4 eq 8105
!
ip access-list extended INSALESREMOTE
permit tcp any host 1.2.3.4 eq 3389
!
ip access-list extended INTEST
remark Allow list INTEST
permit tcp any host 10.1.0.35 eq www
permit tcp any host 10.1.0.35 eq https
!
ip access-list extended INWEBSERVER
permit tcp any host 1.2.3.4 eq www
permit tcp any host 1.2.3.4 eq https
permit tcp any host 1.2.3.4 eq smtp
permit tcp any host 1.2.3.4 eq ftp
!
ip policy-class TEST
allow list INTEST
!
ip policy-class TRUSTED
nat source list MATCHALL address 1.2.3.4 overload
!
ip policy-class UNTRUSTED
nat destination list INWEBSERVER address 10.1.0.35
nat destination list INNS1 address 10.1.0.34
nat destination list INPOSTMAN address 10.1.0.36
nat destination list INCITRIX address 10.1.0.38
nat destination list INMAIL address 10.1.0.40
nat destination list INREMOTE address 10.1.4.102
nat destination list INROSS address 10.1.0.43
nat destination list INMX1 address 10.1.0.45
nat destination list INMERCURY address 10.1.0.46
nat destination list INSALESREMOTE address 10.1.4.103
nat destination list INENGGW1 address 10.1.1.161
nat destination list INENG111 address 10.1.1.111
nat destination list INENG52 address 10.1.1.52
nat destination list INENG143 address 10.1.1.143
nat destination list INENGTUNNEL address 10.1.1.225
!
ip route 0.0.0.0 0.0.0.0 1.2.3.4
!
no ip tftp server
no ip tftp server overwrite
ip http authentication LoginUseLocalUsers
ip http server
ip http secure-server
ip snmp agent
no ip ftp server
ip ftp server default-filesystem flash
no ip scp server
no ip sntp server
!
snmp-server contact "Dave Costello"
snmp-server enable traps snmp
snmp-server source-interface ethernet 0/1
snmp-server community public RO
snmp-server community private RW
snmp-server host 10.1.0.87 traps version 2c public
snmp-server host 10.1.0.87 traps version 2c private
!
ip sip
ip sip proxy
!
line con 0
login authentication LoginUseLinePass
password encrypted 2128d35fc6ac030fa3674a5a9a461c292548
!
line telnet 0 4
login authentication LoginUseLinePass
password encrypted 373eccbd1b8224ccc6b6ef7f8f161a0ee350
no shutdown
line ssh 0 4
login authentication LoginUseLocalUsers
no shutdown
!
sntp server
!
end

[Matt Hobbs]

In my router I needed to allow the management traffic on the TRUSTED interface:

!
ip access-list extended self
remark Traffic to ProCurve SR
permit ip any any log
!

!
ip policy-class TRUSTED
allow list self self
nat source list wizard-ics interface eth 0/1 overload
!


Make sure that the allow is before the NAT entry too.