SNMP set dropped by gateway

[Scott_Paisley]

Hi

We allow SNMP through our gateways, and SNMP gets work fine. Recently we have a requirement to do a set via SNMP but the gateways are dropping it

Inspection Item: SNMP: Non read operation
Inspection Information: SNMP: Non read operation was detected
Severity: Medium
Performance Impact: Medium
Inspection Category: anomaly
Inspection Profile: Recommended Inspection
Action: Drop

We have a policy rule that explicitly allows SNMP traffic. We have an inspection exception for SNMP. Still it gets dropped.

We have a TAC case open but no answers yet.

Anybody know how to make this work?

Thanks

[Lesley]

SNMP v3 is encrypted and fw should not be able to see it. Maybe as workaround? SNMP v3 is best practice anyway.

If does not help you need to make a IPS core protection expection. Firewall rule itself will not affect this. Even if ips blade is not enabled some core protections are enabled by default 

[Scott_Paisley]

We put in an exception. the gateway still drops the traffic

[Lesley]

Need to see traffic log and exception rule screenshot

[Scott_Paisley]

Traffic log

Inspection Item: SNMP: Non read operation
Inspection Information: SNMP: Non read operation was detected
Severity: Medium
Performance Impact: Medium
Inspection Category: anomaly
Inspection Profile: Recommended Inspection
Action: Drop
Type: Log

[Lesley]

https://support.checkpoint.com/results/sk/sk98081

[PhoneBoy]

Need to see the full log card of the drop (mask sensitive details).

[Scott_Paisley]

Time: 2026-05-27T10:21:04Z
Interface Direction: inbound
Interface Name: eth2
Source: x.x.x.x
Source Port: 57217
Destination: y.y.y.y
Destination Port: 161
IP Protocol: 17
Inspection Item: SNMP: Non read operation
Inspection Information: SNMP: Non read operation was detected
Severity: Medium
Performance Impact: Medium
Inspection Category: anomaly
Inspection Profile: Recommended Inspection
Action: Drop
Type: Log
Policy Name: zzz
Policy Management: Manager
Policy Date: 2026-05-27T10:19:26Z
Blade: Firewall
Origin: Gateway1
Service: UDP/161
Product Family: Access
Interface: eth2

[Bob_Zimmerman]

This may be a protocol inspection drop rather than an IPS drop. Check Point includes two different service objects covering SNMP: one named 'snmp' and a separate object named 'snmp-read'. Right-click on the snmp-read object and pick Where Used. Is it in any of your rules or service groups? As the name suggests, that one only allows read operations.

[Scott_Paisley]

we have the snmp object in the rule that should allow the traffic