How to change default SNMP port?

Hi Esrom,

Thank you for reaching out to Sophos Community.

Kindly do the following:

1. Create an FW rule with the Destination and services set to the custom port instead of 161/162

2. Create a DNAT with the following setup

Original Service: Custom Port

Translated Service[PAT]: 161

You may refer to the following KB (PAT)

Sophos Firewall: DNAT/Port forward to an internal server

Hi Esrom,

Thank you for reaching out to Sophos Community.

Kindly do the following:

1. Create an FW rule with the Destination and services set to the custom port instead of 161/162

2. Create a DNAT with the following setup

Original Service: Custom Port

Translated Service[PAT]: 161

You may refer to the following KB (PAT)

Sophos Firewall: DNAT/Port forward to an internal server

Hello, thanks for the reply. Just remembering that it is not SNMP for an internal server, but for Sophos itself. Works on LAN

I did as instructed and let's review the scenario to see if I'm missing something.

Under Device Access:
- Access for SNMP is enabled for LAN Zone

In SNMP:
- Agent Configuration is Enabled
- Community and remote ip for access are configured

Rules:
- I created a Firewall Rule:
Origin Zone/Source Device/Destination Zone = Any
Destination network = #portWAN
Services = UDP 45161 and UDP 45162

- I created two NAT Rules
Rule one:
Original Source/Incoming Interface = Any
SNAT = Original
Original destination = #portWAN
Original Service = UDP 45161
DNAT = Sophos LAN ip
PAT = UDP 161

Rule two:
Original Source/Incoming Interface = Any
SNAT = Original
Original destination = #portWAN
Original Service = UDP 45162
DNAT = Sophos LAN ip
PAT = UDP 162

Unsuccessfully unfortunately

In Packet Capture, it is possible to see the packet entering port 45161, but it is not associated with any firewall or nat rule. The firewall rule transfer counter also remains at 0

Still in Packet Capture.

Status = Violation

Reason = Local_ACL

Any way around?

Hi Esrom Lima  If you are referring to the setup/scenario where Sophos Firewall is configured as an SNMP agent and you would like to change those hardcoded ports on UI then unfortunately as of we do not have any such way. 




You may submit feedback to capture comments and requests within the product itself or you may contact your Sophos partner or sales representative directly to discuss this feature details and to provide the feedback to the relevant team.