Cisco Systems SNMP Inspection Overview, Select SNMP Map, SNMP Inspect Map

14-14
Cisco ASA Series Firewall ASDM Configuration Guide
Chapter14 Configuring Inspection for Management Application Protocols
SNMP Inspection
•“Select SNMP Map” section on page 14-14
•“SNMP Inspect Map” section on page14-14
SNMP Inspection Overview
SNMP application inspection lets you restrict SNMP traffic to a specific version of SNMP. Earlier
versions of SNMP are less secure; therefore, denying certain SNMP versions may be required by your
security policy. The ASA can deny SNMP versions 1, 2, 2c, or 3. You control the versions permitted by
creating an SNMP map.
You then apply the SNMP map when you enable SNMP inspection according to the “Configuring
Application Layer Protocol Inspection” section on page10-7.
Select SNMP Map
Add/Edit Service PolicyRule Wizard > Rule Actions > Protocol Inspection Tab >
Select SNMP Map
The Select SNMP Map dialog box lets you select or create a new SNMP map. An SNMP map lets you
change the configuration values used for SNMP application inspection. The Select SNMP Map table
provides a list of previously configured maps that you can select for application inspection.
Fields
•Use the default SNMP inspection map—Specifies to use the default SNMP map.
•Select an SNMP map for fine control over inspection—Lets you select a defined application
inspection map or add a new one.
•Add—Opens the Add Policy Map dialog box for the inspection.
SNMP Inspect Map
Configuration> Global Objects > Inspect Maps > SNMP
The SNMP pane lets you view previously configured SNMP application inspection maps. An SNMP
map lets you change the default configuration values used for SNMP application inspection.
Fields
•Map Name—Lists previously configured application inspection maps. Select a map and click Edit
to view or change an existing map.
•Add—Configures a new SNMP inspect map.
•Edit—Edits the selected SNMP entry in the SNMP Inspect Maps table.
•Delete—Deletes the inspect map selected in the SNMP Inspect Maps table.
Add/Edit SNMP Map
Configuration> Global Objects > Inspect Maps > SNMP > Add/Edit SNMP Map (You can get to
this dialog box through various paths.)