SNMP works between networks even though routing isn't working.

I just ran into an interesting problem.  I have a network monitoring host on one network 10.5.0.0/16.  I have wireless access points on another network 10.6.1.0/24.  Access between the networks is controlled by a firewall.

I have enabled pings and SNMP on the firewall from 10.5.0.0/16 ---> 10.6.1.0/24.  All other traffic is blocked.  Pings fail, but the network monitoring host on 10.5.0.0/16 is successful in retrieving data from the access points over SNMP.  If I do a trace route, I clearly see a routing problem.  The first hop is the local gateway.  The 2nd hop is out to the internet then it times out.   So I understand that I have a routing problem and I know how to fix it.

My question is:

How can SNMP be working if the routing isn't working?  I am certain that SNMP is working from 10.5.0.0/16 to 10.6.1.0/24.  I set up monitoring on a host 10.5.1.5.  It is  retrieving real time data from 3 access points 10.6.1.6, 7, 8.  

I thought that SNMP relies on UDP which is routable.  How is this SNMP traffic traversing the network boundary when the routes are failing?

Just curious ...
sillzAsked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

x
 
QlemoConnect With a Mentor Batchelor, Developer and EE Topic AdvisorCommented:
There needs to be more than revealed. ICMP, UDP, TCP all require routing. If the 10.5.0.0/16 network has the router as default gateway (with a 10.5.0.0/16 address) which connects both networks, and the same applies to other network (with 10.6.1.0/24 addresses, of course), routing should be fine. As said by arnold, the default gateway is responsible for routing all traffic. And if it the same, as I assume, as your firewall, then you have a firewall issue, no routing issue.

There might be flaws in devices to ignore the subnet mask for one protocol and not the other. That might be an additional issue. Devices ignoring the subnet mask would expect both networks to be the same, no routing involved, which again would explain that some traffic cannot pass.
0
 
Steve JenningsIT ManagerCommented:
It isnt actually clear from your description whether it is really working or not. An SNMP trap only needs to work unidirectionally,that is, a trap from your wireless net to your other net may work even though the reverse does not. Ping is bidirectional, and must be open in both directions thru the fire wall.

If however you are saying the you can do an SNMP GET from one network to the wireless network and you successfully get data  then that means you have opened SNMP in both directions and ping is either not open in both directions or something else is misconfigured.

Steve
0
 
arnoldCommented:
"I have enabled pings and SNMP on the firewall from 10.5.0.0/16 ---> 10.6.1.0/24."
Check the routing table where 10.5.0.0/16 connects and 10.6.1.0/24 connect

Each segments sends its packet up to the default gateway.
Which system are you using to perform the traceroute?
windows uses icmp packet which should follow the route of a ping and be allowed through. linux/unix use UDP packets which you've not included in the allow rule, which likely means that it is only allowed to flow out the default gateway to the internet where it dies a non-routing death.
http://en.wikipedia.org/wiki/Traceroute
0
 
sillzAuthor Commented:
Thanks steve. I am doing an SNMP get from 10.5.1.5 to the 3 wireless access points in 10.6.1.0. The firewall policy allows ping and snmp. I know snmp is working because i see data in my interface utilization charts that match test traffic i create through one access point and i can do an snmpwalk from the solarwinds box against the access point. If i disable the firwall policy snmp stops working. Ping never works whether the policy is turned on or off.
0
 
sillzAuthor Commented:
Thanks Qlemo,

You were correct.  I had enabled the firewall policies on our main firewall, but there were "firewall filters" in place on our Juniper switch.  SNMP had been allowed, but PING had not been allowed.  Adding a firewall filter on the switch for PING resolved the problem.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.