diff --git a/deployment/snmp/snmp-baremetal-puppet.yaml b/deployment/snmp/snmp-baremetal-puppet.yaml
index 2869f07feb..e3802eaaba 100644
--- a/deployment/snmp/snmp-baremetal-puppet.yaml
+++ b/deployment/snmp/snmp-baremetal-puppet.yaml
@@ -66,21 +66,26 @@ outputs:
         tripleo::profile::base::snmp::snmpd_password: {get_param: SnmpdReadonlyUserPassword}
         snmp::agentaddress: {get_param: SnmpdBindHost}
         snmp::snmpd_options: {get_param: SnmpdOptions}
-        snmpd_network:
-          # TODO(hjensas): Replace with get_param: [ServiceData, net_cidr_map, {get_param: [ServiceNetMap, SnmpdNetwork]}
-          str_replace:
-            template: "%{hiera('$NETWORK_subnet')}"
-            params:
-              $NETWORK: {get_param: [ServiceNetMap, SnmpdNetwork]}
         tripleo::snmp::firewall_rules:
-          '124 snmp':
-            dport: 161
-            proto: 'udp'
-            source:
-              if:
-              - snmpd_network_unset
-              - "%{hiera('snmpd_network')}"
-              - {get_param: SnmpdIpSubnet}
+          if:
+            - snmpd_network_unset
+            - map_merge:
+                repeat:
+                  for_each:
+                    <%net_cidr%>:
+                      get_param:
+                        - ServiceData
+                        - net_cidr_map
+                        - {get_param: [ServiceNetMap, SnmpdNetwork]}
+                  template:
+                    '124 snmp <%net_cidr%>':
+                      dport: 161
+                      proto: 'udp'
+                      source: <%net_cidr%>
+            - '124 snmp':
+                dport: 161
+                proto: 'udp'
+                source: {get_param: SnmpdIpSubnet}
       step_config: |
         include ::tripleo::profile::base::snmp
       upgrade_tasks: