8

I have a Juniper MX router that is accepting SNMP requests. Problem is I am sending UDP requests to one interface, and it is replying on another. The target IP is that which is assigned to lo0.1 but the router is replying on lo0.0. This is problematic as the IP address for lo0.0 is what is specified on an exterior firewall. Is there a way to define what interface needs to reply to the snmp requests?

Wild Bill
  • 401
  • 1
  • 5
  • 9
  • Can you check if you have "default-address-selection" enabled (use 'show configuration system')? – Jordan Head Mar 31 '15 at 13:47
  • I do have that enabled. Removing that would resolve this I believe, but I'm not looking to impact anything other than SNMP ideally. – Wild Bill Mar 31 '15 at 14:00
  • Deleted my old comment, adding this one.

    What would have to change with the firewall in order for the return traffic to be okay on lo0.0, or is it another concern?

     – Jordan Head Mar 31 '15 at 15:54
  • 1
    Unfortunately, I couldn't find anything that would let you adjust the source address for normal SNMP queries (trap sources are always adjustable) while having "default-address-selection" enabled. – Jordan Head Apr 01 '15 at 18:24
  • When you say "the IP address for lo0.0 is what is specified on an exterior firewall" do you mean the lo0.0 IP is duplicated in two locations, both on your router and on an external firewall? – cpt_fink May 06 '15 at 03:19
  • Could you add to your OQ: @IP of lo0.0 & lo0.1 and the configuration lines of your snmp server configuration? – dan Jul 05 '15 at 10:36
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer. – Ron Maupin Jan 03 '21 at 20:03

3 Answers3

2

Junos can't have multiple loopback interfaces in the same routing-instance, so you'll need to enable snmp in routing-instances first:

set snmp routing-instance-access

Obviously you'll also need a route inside your routing-instance that will get return traffic back to your SNMP poller.

Benjamin Dale
  • 9,421
  • 17
  • 46
0

Not being a JunOS expert, but in Cisco-land the snmp source-address x.x.x.x command would fix your issue. Here's the JunOS documentation I was able to locate:

Syntax
source-address address;
Hierarchy Level
[edit snmp trap-options]

http://www.juniper.net/techpubs/en_US/junos14.2/topics/reference/configuration-statement/source-address-edit-snmp.html

cpt_fink
  • 1,470
  • 7
  • 17
  • if I understand the problem, he is sending SNMP get or walks to one address, and receives replies from another. SNMP get!=trap; your answer talks about traps. I wonder whether this is a problem that could be solved by polling a different loopback – Mike Pennington May 06 '15 at 02:54
  • That was the part that confused me, how would an SNMP system (or any IP system...) respond to a request with a different source IP address and expect the conversation to complete correctly? – cpt_fink May 06 '15 at 03:07
  • 2
    So the option he has configured (default-address-selection) will take any system service (SNMP, NTP, whatever) and use the Loopback address as the source, instead of the interface. UNLESS, you specifically set source-address flags under each service, the unfortunate part is that this is supported by SNMP traps ONLY, not the gets/walks. Even pings to interfaces will have a different source address if this is enabled, so you have to be careful. If default-address-selection were removed, the interface IP would be the source (this is default). – Jordan Head May 06 '15 at 18:33
-1

The router is going to reply to the source IP address of the SNMP packet, right? I imagine that you would look in the routing table for the route to the subnet of the source packet to determine where the response goes. Normally, this would be the same interface that it received that packet on. You could always to some type of policy-based routing where you could force traffic desitned to [source address of SNMP packet] out of interface [whichever].

Hope that helps.

Ronnie Royston
  • 4,399
  • 1
  • 12
  • 28