How to change default SNMP port?

Hi Esrom,

Thank you for reaching out to Sophos Community.

Kindly do the following:

1. Create an FW rule with the Destination and services set to the custom port instead of 161/162

2. Create a DNAT with the following setup

Original Service: Custom Port

Translated Service[PAT]: 161

You may refer to the following KB (PAT)

Sophos Firewall: DNAT/Port forward to an internal server

Hello, thanks for the reply. Just remembering that it is not SNMP for an internal server, but for Sophos itself. Works on LAN

I did as instructed and let's review the scenario to see if I'm missing something.

Under Device Access:
- Access for SNMP is enabled for LAN Zone

In SNMP:
- Agent Configuration is Enabled
- Community and remote ip for access are configured

Rules:
- I created a Firewall Rule:
Origin Zone/Source Device/Destination Zone = Any
Destination network = #portWAN
Services = UDP 45161 and UDP 45162

- I created two NAT Rules
Rule one:
Original Source/Incoming Interface = Any
SNAT = Original
Original destination = #portWAN
Original Service = UDP 45161
DNAT = Sophos LAN ip
PAT = UDP 161

Rule two:
Original Source/Incoming Interface = Any
SNAT = Original
Original destination = #portWAN
Original Service = UDP 45162
DNAT = Sophos LAN ip
PAT = UDP 162

Unsuccessfully unfortunately

In Packet Capture, it is possible to see the packet entering port 45161, but it is not associated with any firewall or nat rule. The firewall rule transfer counter also remains at 0

In Packet Capture, it is possible to see the packet entering port 45161, but it is not associated with any firewall or nat rule. The firewall rule transfer counter also remains at 0