Chapter 27: Snmp Proxy - Tavve zoneranger User Manual

Chapter 27: SNMP Proxy

A Ranger Gateway and one or more joined ZoneRangers can provide an SNMP proxy service, enabling
management applications to have SNMP access to devices in firewall-partitioned networks (e.g. DMZs)
without requiring the firewall to be configured to allow SNMP traffic.
The following figure provides a high-level overview of an SNMP proxy transaction.
Figure 27-1. ZoneRanger SNMP Proxy
The basic steps of an SNMP proxy transaction are as follows:
1. A management application generates an SNMP Get or SNMP Set request, intended for a
specific managed device.
2. The Ranger Gateway receives/intercepts the request.
3. The Ranger Gateway checks the Proxy Access Control configuration to verify that the request
should be allowed, and to identify the proxy service to which the request should be forwarded
(i.e. SNMP Proxy).
4. The SNMP Proxy service in the Ranger Gateway consults with the Proxy Map service in order
to select a ZoneRanger that is able to relay the request to the target device.
5. The ZoneRanger forwards the request to the target device.
6. The target device generates a response and sends it to the requesting ZoneRanger.
7. The ZoneRanger forwards the response to the Ranger Gateway.
8. The Ranger Gateway forwards the response to the management application.
Management applications can access the SNMP Proxy service in a variety of ways, as described in the
following sections.
GVI/RGVI
When using GVI or RGVI, the management application sends SNMP requests intended for a
managed device to the actual address of the target device, or an address that can be uniquely
mapped to the target device. The management application server is configured with static routing
rules, so that traffic destined for devices located in firewall-partitioned networks is routed to a
virtual interface, which then forwards the traffic to the Ranger Gateway.
Consider the network example in the following figure. Two DMZ's are shown. The first DMZ has
one ZoneRanger (ZR-1) and the second one has two (ZR-2, ZR-3). The IP addresses in the two
DMZ's do not overlap.
ZoneRanger 5.5 User's Guide 80