etingof / snmpfwd

SNMP Proxy Forwarder
http://snmplabs.com/snmpfwd/
BSD 2-Clause "Simplified" License
67 stars 18 forks source link

OIDfilter config #37

Closed Pelleplast closed 5 years ago

Pelleplast commented 5 years ago

Hi! So I'm trying to configure OIDfiltering to be able to restrict users in the MIBtree based on both their IP and community string. I have a Proxy behind a firewall. The firewall redirects the traffic to the proxy. I'm having problem getting respons from my manager (with public IP) when I'm running this line.

snmpget -v2c -c test 213.79.163.67:161 1.3.6.1.2.1.2.2.1.8.2

This is the respons from that.

Timeout: No Response from 192.168.1.100.

If i run this command from the proxy i get respons but can i query any OID i want so the filtering doens't work

snmpget -v2c -test 192.168.1.100 1.3.6.1.2.1.2.2.1.8.2

but with -v1 i get

Timeout: No Response from 192.168.1.100.

I don't know If I've missunderstood the config or what it is.

This is my server conf

config-version: 2
program-name: snmpfwd-server

test-1 {
  snmp-transport-domain: 1.3.6.1.6.1.1.100
  snmp-bind-address: PublicIP:161
  snmp-engine-id: 0x0102030405070809
  snmp-community-name: test
  snmp-security-name: test-user
  snmp-security-model: 2
  snmp-security-level: 1
  snmp-credentials-id: test-1
}

context-group {
  snmp-context-engine-id-pattern: .*?
  snmp-context-name-pattern: .*?
  snmp-context-id: any-context
}

content-group {
  snmp-pdu-type-pattern: (GET|SET|GETNEXT|GETBULK)
  snmp-pdu-oid-prefix-pattern-list: .*?
  snmp-content-id: any-content
}

peers-group {
  snmp-transport-domain: 1.3.6.1.2.1.2.2.1.8.1
  snmp-bind-address-pattern-list: .*?
  snmp-peer-address-pattern-list: .*?
  snmp-peer-id: 100
}

plugin-modules-path-list: /home/ueexjobo/.local/snmpfwd/plugins/

plugin-group {
  plugin-module: oidfilter
  plugin-options: config=/home/ueexjobo/.local/snmpfwd/plugins/oidfilter.conf log-denials=true
  plugin-id: permit-system-branch
}

trunking-group {
  trunk-crypto-key: 1234567890
  #Endpointaddress för trunk
  trunk-bind-address: 192.168.1.100
  trunk-peer-address: 192.168.1.100:30301
  trunk-ping-period: 60
  trunk-connection-mode: client
  trunk-id: trunk-1
}

routing-map {
  matching-snmp-context-id-list: any-context
  matching-snmp-content-id-list: any-content
  matching-snmp-credentials-id-list: test-1
  matching-snmp-peer-id-list: 100
  using-plugin-id-list: permit-system-branch
  using-trunk-id-list: trunk-1
}

And my client conf

config-version: 2
program-name: snmpfwd-client

peers-group {
  snmp-engine-id: 0x0102030405070809
  snmp-transport-domain: 1.3.6.1.6.1.1.1
  #Originate SNMP packets from this transport address endpoint
  snmp-bind-address: 0.0.0.0:0
  snmp-peer-timeout: 100
  snmp-peer-retries: 1
  snmp-community-name: test
  #Idintifier that logically groups SNMP configuration settings together.
  snmp-security-name: testing
  #Snmp v1, v2c eller v3
  snmp-security-model: 2
  #1=no auth, 2=auth no encry, 3=aut/encry
  snmp-security-level: 1
  #Send SNMP packets to this network address
  snmp-peer-address: PublicIP
  snmp-peer-id: snmplabs
}

trunking-group {
  trunk-bind-address: 192.168.1.100:30301
  trunk-ping-period: 60
  trunk-connection-mode: server
  trunk-id: <discover>
}

original-snmp-peer-info-group {
  orig-snmp-bind-address-pattern: .*?
  orig-snmp-context-name-pattern: .*?
  orig-snmp-pdu-type-pattern: .*?
  orig-snmp-oid-prefix-pattern: .*?
  orig-snmp-engine-id-pattern: .*?
  orig-snmp-context-engine-id-pattern: .*?
  orig-snmp-transport-domain-pattern: .*?
  orig-snmp-peer-address-pattern: .*?
  orig-snmp-security-level-pattern: .*?
  orig-snmp-security-name-pattern: .*?
  orig-snmp-security-model-pattern: .*?
  orig-snmp-peer-id: manager-1
}

server-classification-group {
  server-snmp-credentials-id-pattern: .*?
  server-snmp-context-id-pattern: .*?
  server-snmp-content-id-pattern: .*?
  server-snmp-peer-id-pattern: .*?
  server-classification-id: any-classification
}

routing-map {
  matching-trunk-id-list: trunk-1
  matching-orig-snmp-peer-id-list: manager-1
  matching-server-classification-id-list: any-classification
  using-snmp-peer-id-list: snmplabs
}