Unidirectional access

Hello,

You can configure a traffic policy to implement unidirectional access for ICMP and TCP services. The ping process involves the exchange of ICMP Echo Request and Reply packets. Therefore, you can configure an ACL to match the Echo packets initiated from other network segments and destined to the O&M network segment, and define the deny action for matched packets in the ACL.Similarly, in the TCP three-way handshake, the initiator sends an SYN request packet. You can configure an ACL to match SYN packets sent from other network segments to the NMS network segment, and define the deny action for matched packets in the ACL.

Kindly refer to the below configuration:

#

acl number 3001

 rule 15 permit icmp source 10.10.0.0 0.0.255.255 destination 10.100.0.0 0.0.0.255 icmp-type echo

 rule 20 permit tcp source 10.10.0.0 0.0.255.255 destination 10.100.0.0 0.0.0.255 tcp-flag syn

#

traffic classifier c1

 if-match acl 3001

#

traffic behavior b1

 deny

#

traffic policy p1

 classifier b1 behavior c1

#

interface GigabitEthernet0/0/0

 traffic-policy c1 outbound         //  Apply the traffic policy to the interface connected to the NMS.

#

Refer to: https://support.huawei.com/enterprise/en/knowledge/EKB1100020242

Please let me know if this works.

Procedure:
1. Check whether the SNMP configurations on the host are correct.
- If the SNMP configurations are correct, go to Step 2.
- If the SNMP configurations are incorrect, change the configuration based on the following configuration cases.
2. Run the display snmp-agent trap all command to check whether the trap function is enabled.
- If the trap function is not enabled, run the snmp-agent trap enable command to enable the host to send trap messages.
- If the trap function is enabled, go to Step 3.
3. Check whether the log message indicating that a specific trap is generated exists on the host.
- If the log message indicating that a specific trap is generated does not exist on the host, the trap is not generated. Go to Step 4.
- If the log message indicating that a specific trap is generated exists on the host, the trap has been generated, but the NMS fails to receive the trap message. Go to Step 4.
4. Collect the following information and contact technical support personnel:
- Results of the preceding troubleshooting procedure
- Configuration files, log files, and alarm files of the devices

https://support.huawei.com/enterprise/en/doc/EDOC1000079719/cde96f61/the-nms-fails-to-receive-trap-messages-from-the-host