SNMP Alerts through a Firewall using NAT

[Brian Charlton]

We have several servers on a DMZ on a firewall.

Network address translation (NAT) is used on the firewall to translate the servers on the DMZ from a 172.16.x.x address to a 10.x.x.x address

The SIM console sits on the LAN on a 10.x.x.x address and finds the servers with out a problem using the auto discovery and I can also run PMP etc….

The problem I have is that when one of the servers generates an SNMP trap (or using the send test trap), the trap gets sent to the SIM console but SIM doesn’t do anything with it.

I have used a packet analyzer and it would appear that on the SNMP packet has original IP Address of 172.16.x.x is encapsulated into it and therefore the SIM console doesn’t recognise a server on 172.16.x.x as it’s been NAT’d on the firewall.

Can anyone help???

[Brent Seizer]

On your HP SIM CMS server, check the addresses that you are accepting SNMP traps from and if need be, add the 172.16.x.x IP addresses of the DMZ servers.

Also make sure that your DMZ server names are in DNS.

[Brian Charlton]

Thanks for the reply,

The SIM console accepts SMNP from anyone.

and they can be resolved using DNS

??