Controlling SNMP Query Port(s) on IM7.x

[Darren Head]

Is there any way to restrict IM7 SNMP queries to use a specific range of source ports when querying devices? I would like to monitor Insight agents through a firewall, but I'm finding that SNMP queries are initiating on random high ports, and that the agents respond (of course) on these ports and are blocked by the firewall. I would prefer not to have to open inbound UDP traffic on ALL high ports on the firewall, even if it's only back to my IM7 server. I know queries can be restricted in other solutions like CA Unicenter.

Is this option available in IM7?

Thanks!

- Darren

[David Claypool]

IM7 and the Insight agents use the standard Windows SNMP service without modification. All traffic should be on ports 161 and 162. If you are seeing SNMP on other ports, make sure you don't have some other agentware or SNMP layer hanging around.

[Darren Head]

Thanks David,

You are right that communication is based on standard SNMP ports 161/162.

However, TCP/IP makes the connection to port 162 on the client from IM7 on a random source port. What I would like to do is restrict that source port used by the server to a known range.

If this isn't making sense, try running a netstat -a on your IM7 box while sending an SNMP query to a client and you'll see what I mean.

Cheers!

- Darren

[Andrei Khairetdinov]

In my configuration only port 161 is open from IM server to the managed server i.e. to read, and only port 162 from managed server to IM server to send traps. Also ports 2301 and 2381 are enabled, as well as ICMP port 7 for PING. Everything works fine. No other ports are open.