MX and Up Guard reporting port 161 open

[bkraut]

Hi, have a customer who is using Up Guard to scan their network and are reporting port 161 open and are concerned. Though I’m unable to see this port open from external testing and even put a FW rule into block it, they’re saying it’s still showing as open. Has anyone else seen or heard of this?

Thanks for any clarity. 

Bob. 

[Brash]

Port 161 is SNMP.

Check if SNMP is enabled externally on the MX. 

https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/SNMP_Overview_and_C...

[bkraut]

Hello,

Thank you for your reply but trying to block it from being able to be polled. Not to allow it.

Will review my rules tomorrow however. 

Kind regards,

Bob

[alemabrahao]

Check the firewall rules. https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/MX_Firewall_Settings

[bkrautner]

Hello,

Thank you for your reply. Have looked at that, but, as customer seems to be running Up Guard from inside their LAN and that's the only place they see it open. Having a meeting with them later today to get clarification on the actual issue.

[ww]

You cant block it on the mx itself. Only disable it

Or you need to block it on any downstream lan device

[bkrautner]

Hi,

Thanks for your reply. Leaning towards option 2, as customer seems to be running Up Guard from inside their LAN and that's the only place they see it open. Having a meeting with them later today to get clarification on the actual issue.

Bob

[bkrautner]

Hi,

Thanks again for your reply. Issue is that they don't want to see it open, but, I am having a meeting with the customer later today to get clarification on the actual issue, as they reporting the issue from Up Guard testing running from inside their LAN. My main problem now, is I have no familiarity with Up Guard and how it works, and the little I've found on the net in general hasn't been much help.

[bkrautner]

Hi, 

Just a quick update on status here. Apologies for not having accepted any of the provided answers as the correct answer. Which is more my fault due to not providing the full and correct information. Having a meeting with customer today (last week was postponed by customer as they had to resolve other issues).

Once we've had the meeting to ascertain the correct issue, will either close this query, or update it as/if required.

Thank you all again for what you've provided so far.

Kind regards,

Bob K.