How to enable SNMP via WAN on Sophos XG v19.5

Hi sneader,

Thank you for reaching out to Sophos Community.

I've found an old post from you with the same queries and a solution. 

community.sophos.com/.../snmp-on-wan-not-working

Any ideas on how to make SNMP work on the WAN?

Hi sneader,

I'll check this one with our internal team and update you

Hi sneader,

I'll check this one with our internal team and update you

Thanks for your help, Erick! I will wait to see what you find out.  

Hello Sneader,

Adding to what Erick has mentioned, would you be able to delete and redo the DNAT rule using the Sophos Assistant "DNAT and Firewall Rules for internal web server." If the issue persists and you are ok enabling Access ID to your device let me know and I can take a look.

Are you a home user or a Business user? 

Regards,

Hi Emmanuel.  I attempted to use "Server access assistant (DNAT)" but without success.  Right now, here is what I have in the Sophos

Firewall rule:  
   Source Zone:  WAN
   Source Networks and Devices:  A specific IP on the public Internet
   Destination Zones:  Any
   Destination networks:  #PORT3 (this is my WAN port, with public IP)
   Services:  SNMP UDP 6161

NAT Rules:
   Original Source:  Any
   Original Destination:  #PORT3 (this is my WAN port, with public IP)
   Original Service:  SNMP UDP 6161
   Translated source (SNAT):  Original
   Translated destination (DNAT): LAN Port IP
   Translated service (PAT):  SNMP UDB 161
   Inbound Interface:  Port3
   Outbound Interface:  Any

I am attempting to accept UDP 6161 packets from a specific external IP, and translate it to UDP 161, and send the traffic to the Sophos, so that it can receive and respond to SNMP packets.  How can we make this work, like it did in version 17?

I am a home user. I would be happy to allow your access if you tell me how.  But I would prefer that you let me try to fix it, with your advice. I just need to know how the Sophos could be accessed for SNMP, on an alternate port number.  Thanks!

- Scott

Hi Scott,

For the access ID you can see below for reference:

docs.sophos.com/.../SupportAccess.html

Thanks for the clear instructions, Erick. I have enabled the access and sent you a PM with the details.