Block access to SNMP service from internet

[azaan]

Hi, 

Can anyone guide me how to block SNMP service from internet on fortinet. 

Thanks 

[emnoc]

We are assuming snmp access to the FGT? Use the snmp host entries and enable SNMP allowaccess  only on the  interface(s) that you need.

e.g cli

 config hosts                 edit 1                     set ip 12.130.11.0 255.255.255.0                 next                 edit 2                     set ip 207.18.1.8 255.255.255.255                 next

                edit 3                     set ip 207.19.1.89 255.255.255.255                 next             end

[azaan]

Hi, 

Thanks for your reply, 

Can we block ports like TC/UDP - 161, 162 for any incoming traffic from internet. or is there any other way to do this. 

[oheigl]

Like emnoc said: Just disable the SNMP in the allow access settings of your WAN interface. This way the FortiGate doesn't listen on the SNMP ports anymore for this interface

[rwpatterson]

Unless explicitly allowed, the Fortigate will silently dump any traffic pointed at it. If you don't open that interface to SNMP, it won't do anything with it but simply ignore it. From the GUI, simply allow the common protocols you wish to expose to the Internet. For security, I only allow HTTPS and PING. If I want secure shell, I open an SSL VPN tunnel and come in from the inside. HTTP on the outside interface is just plain silly.