search cancel

How to prevent a trap from being forwarded using using the Secure Domain Connector (SDC) TrapX

book

Article ID: 229599

calendar_today

Updated On:

Products

CA Spectrum DX NetOps

Issue/Introduction

We use SDC-TrapX as trap receiver and forward to Spectrum.

There are many unknown traps that are forwarded to Spectrum. How can we block those unknown traps from being forwarded to Spectrum via SDC-TrapX?.

Here is an example:

Model URL : https:/OneClick:8443/spectrum/oneclick.jnlp?topology=0x369667
  Severity : 
Created On : Nov 29, 2021 2:14:21 PM EST
      Name : Device
     Event : Unknown alert received from device Device of type GnCiscoDev. Device Time 189+14:35:32. (Trap type 1.3.6.1.4.1.9.6.1)
             Trap var bind data: 
             OID:  1.3.6.1.4.1.9.2.9.3.1.1.644.1  Value:  6
             OID:  1.3.6.1.2.1.6.13.1.1.10.49.128.65.22.142.245.207.76.43135  Value:  5
             OID:  1.3.6.1.4.1.9.2.6.1.1.5.10.49.128.65.22.142.245.207.76.43135  Value:  380
             OID:  1.3.6.1.4.1.9.2.6.1.1.1.10.49.128.65.22.142.245.207.76.43135  Value:  8505
             OID:  1.3.6.1.4.1.9.2.6.1.1.2.10.49.128.65.22.142.245.207.76.43135  Value:  10923
             OID:  1.3.6.1.4.1.9.2.9.2.1.18.644  Value:  Value
             
Created By : System

Environment

Release : Any

Component : Spectrum Trap-X

Resolution

Using the above trap oid as an example, add the following filter near the top of the trapX.conf file as one of the first filters evaluated:

filter * * * 6 1 1\.3\.6\.1\.4\.1\.9 break

break: This action causes no action to be taken for a given trap. No further filter processing is done on the current Trap PDU, and does not evaluate any remaining filters for the current Trap. Any option to this action is ignored.

The reason you want to place this near the top of the trapX.conf file as one of the first filters evaluated is so no other filters will be evaluated that may cause this trap to be forwarded.

Additional Information

Please reference the "SDC TrapX Support" section of the documentation for more information.