Enable SNMP to allow SNMP connect to router

RouterOS General
1

I have a LibreNMS server running in Microsoft Azure. It uses SNMP to poll network devices. I have successfully allowed SNMP communication to devices on the network. However, I cannot get SNMP on the router to respond to requests. I am new to MicroTik configuration and learning as I go. Claude (AI) and I have managed to get a lot working, but not this functionality/connectivity. I am running an RB5009UG+S+ with version 7.16.2 (stable) and factory software 7.4.1. Here is the /snmp print from the router:

enabled: yes
contact:
location:
engine-id-suffix:
engine-id: 80003a8c04
src-address: 0.0.0.0
trap-target: <>
trap-community: CEMTINMS
trap-version: 2
trap-generators:
trap-interfaces: all
vrf: main

I have also tried setting the trap-target to the private IP of the server. What am I missing?

2

first, look at input chain in firewall
you should enable 161/udp

3

I appreciate the suggestion. I have already done that. I should have said that in my first post. I have included my firewall rules below. I have tried using both the private and public IP addresses of the firewall in these rules with no luck. Are there other settings I need to change in other menus to get this to work?

1 ;;; Azure_VPN_ALLOW_UDP
chain=input action=accept protocol=udp src-address=<> src-address-list=allow-in dst-port=500,4500
log=no log-prefix=""

2 ;;; AZURE_VPN_ALLOW_IPSEC
chain=input action=accept protocol=ipsec-esp src-address=<> log=no log-prefix=""

3 ;;; SNMP_ALLOW_IN_NMS
chain=input action=accept protocol=udp src-address=<> dst-address=<> in-interface=ether4
dst-port=161 log=no log-prefix=""

4 ;;; SNMP_ALLOW_OUT_NMS
chain=output action=accept protocol=udp src-address=<> dst-address=<> out-interface=ether4
src-port=161 log=no log-prefix=""

5 ;;; ICMP_ALLOW_IN_NMS
chain=input action=accept protocol=icmp src-address=<> dst-address=<> in-interface=ether4
log=no log-prefix=""

6 ;;; ICMP_ALLOW_OUT_NMS
chain=output action=accept protocol=icmp src-address=<> dst-address=<> out-interface=ether4
log=no log-prefix=""

7 ;;; ICMP_ALLOW
chain=input action=accept protocol=icmp limit=3,5:packet log=no log-prefix=""

4

Is ether4 stand-alone interface or member of a bridge?

If the shown code is complete firewall, then it's not firewall that blocks SNMP, default action (at the end of each chain) is accept and code snippet doesn't contain any drop rule.

5

All traffic goes through ether8. The ether4 is to our DMZ. Let me try to describe in another way. I have another subnet, x.x.20.0/24, setup with the same firewall filter and NAT rules as the problem subnet, x.x.99.0/28. My firewall is x.x.99.1. Both ICMP and SNMP traffic are allowed through by these rules. I can ping the firewall from the Azure server, but SNMP still does not come through. Any further thoughts after this information?

6

Have you checked the 'communities' setting on the SNMP config page, it can be restricted by IP subnet/address (probably a good idea if your SNMP port is publically accessible).

Also turn off bulk requests in your NMS.