SNMP SET with ACL and Set Community Name

Question

Hi All,

I need to perform a SNMP Set operation in a printer in the network which as an Access Control List configured (ACL) and my host's IP Address is not in the ACL table. I'm getting a strange behavior: When I have a SNMPv1 Set community name configured, I am ONLY able to perform a SNMP Set if my host ip is in the ACL table. If there is no SNMPSet community name configured, I am able to perform SNMP Set normally even if my ip address is not in the ACL table. So, does anyone know if there is any relationship between the ACL table and the SNMP Set community name? I mean, the ACL is only "working" when the set community name is configured. Does this make sense?

Thanks for any help

Answer 1

So the ACL is on a local router or the printer itself? What model of printer is it and how are you connected to it, are you on the same network or do you pass through the router to get to the printer which is on a seperate network range?

I would check the full ACL list as perhaps there is a block all rule that is stopping you from accessing atm.

Answer 2

The ACL is on the printer itself. We are connected through a network and the printer is in another subnet. The ACL contains only one entry and there is not a blocking rule. The issue itself is regarding the behavior related with the SNMP Set Community itself that I'd like to understand if there is any relationship between them.

Answer 3

As far as I know, such ACL is not a default part of SNMP, and its function can be varied by the vendor.

Like your test revealed, this may be a security flaw. Consider reporting this issue to the vendor. If they have a fix, they will send to you.