topic Re: SNMP set dropped by gateway in Firewall & Security Management

SNMP set dropped by gateway

Scott_Paisley — Wed, 27 May 2026 10:24:41 GMT

We allow SNMP through our gateways, and SNMP gets work fine. Recently we have a requirement to do a set via SNMP but the gateways are dropping it

Inspection Item: SNMP: Non read operation
Inspection Information: SNMP: Non read operation was detected
Severity: Medium
Performance Impact: Medium
Inspection Category: anomaly
Inspection Profile: Recommended Inspection
Action: Drop

We have a policy rule that explicitly allows SNMP traffic. We have an inspection exception for SNMP. Still it gets dropped.

We have a TAC case open but no answers yet.

Anybody know how to make this work?

Thanks

Re: SNMP set dropped by gateway

Lesley — Wed, 27 May 2026 11:41:59 GMT

SNMP v3 is encrypted and fw should not be able to see it. Maybe as workaround? SNMP v3 is best practice anyway.

If does not help you need to make a IPS core protection expection. Firewall rule itself will not affect this. Even if ips blade is not enabled some core protections are enabled by default

Re: SNMP set dropped by gateway

Scott_Paisley — Wed, 27 May 2026 12:05:26 GMT

We put in an exception. the gateway still drops the traffic

Re: SNMP set dropped by gateway

Lesley — Wed, 27 May 2026 12:27:14 GMT

Need to see traffic log and exception rule screenshot

Re: SNMP set dropped by gateway

Scott_Paisley — Wed, 27 May 2026 12:34:38 GMT

Traffic log

Re: SNMP set dropped by gateway

Lesley — Wed, 27 May 2026 16:55:45 GMT

https://support.checkpoint.com/results/sk/sk98081

Re: SNMP set dropped by gateway

PhoneBoy — Wed, 27 May 2026 17:03:19 GMT

Need to see the full log card of the drop (mask sensitive details).

Re: SNMP set dropped by gateway

Scott_Paisley — Wed, 27 May 2026 17:06:33 GMT

Time: 2026-05-27T10:21:04Z
Interface Direction: inbound
Interface Name: eth2
Source: x.x.x.x
Source Port: 57217
Destination: y.y.y.y
Destination Port: 161
IP Protocol: 17
Inspection Item: SNMP: Non read operation
Inspection Information: SNMP: Non read operation was detected
Severity: Medium
Performance Impact: Medium
Inspection Category: anomaly
Inspection Profile: Recommended Inspection
Action: Drop
Type: Log
Policy Name: zzz
Policy Management: Manager
Policy Date: 2026-05-27T10:19:26Z
Blade: Firewall
Origin: Gateway1
Service: UDP/161
Product Family: Access
Interface: eth2

Re: SNMP set dropped by gateway

Bob_Zimmerman — Wed, 27 May 2026 17:15:07 GMT

This may be a protocol inspection drop rather than an IPS drop. Check Point includes two different service objects covering SNMP: one named 'snmp' and a separate object named 'snmp-read'. Right-click on the snmp-read object and pick Where Used. Is it in any of your rules or service groups? As the name suggests, that one only allows read operations.

Re: SNMP set dropped by gateway

Scott_Paisley — Thu, 28 May 2026 07:16:53 GMT

we have the snmp object in the rule that should allow the traffic

Re: SNMP set dropped by gateway

surya — Tue, 29 Sep 2026 05:46:35 GMT

Hi @Scott_Paisley ,

Any solution for this issue?

Re: SNMP set dropped by gateway

Chris_Atkinson — Tue, 29 Sep 2026 07:49:28 GMT

What does your rule allowing the traffic look like, which objects are in the services column of the rule?

Re: SNMP set dropped by gateway

surya — Wed, 30 Sep 2026 05:51:43 GMT

Hi @Chris_Atkinson

SNMP services only is added in service column.

Re: SNMP set dropped by gateway

Chris_Atkinson — Wed, 30 Sep 2026 06:54:12 GMT

Defined like this?

Re: SNMP set dropped by gateway

surya — Wed, 30 Sep 2026 09:15:25 GMT

Hi @Chris_Atkinson ,

Issue resolved, I have allowed the SNMP port like attached Image.

Also when i debug the traffic i am getting this error in CLI. Checkpoint is refers below document for this issue.

"dropped by fw_conn_post_inspect Reason: Handler 'snmp_ro_code' drop;"

https://support.checkpoint.com/results/sk/sk103405