Comunity string question.

I am going to be installing SNPM on 10 Servers, 2 Dell GB Managed Switches and 2 Dell Managed Fast Ethernet Switches.
I am new at this and have a few questions.

Should it also be installed on the Router providing WAN access to our other sites?

Question about the community string, I understand it is like a password. I think of a string as a line between 2 objects. Can I create a single string (password) for all the devices, or do I need 1 per device?

Urgent...

Thanks in Advance… Michael
Linux_HawkAsked:
Who is Participating?
 
PsiCopCommented:
Most folx use one SNMP community string for read access on all devices, and a different one for Read-Write. Whether or not you should use a different R/W community string on each device is something only you can answer - depends on the importance of security in your environment. But then if security were a critical concern, you wouldn't be using SNMP, since its fairly insecure.

Do make sure SNMP traffic is not permitted outside your network to the Internet. If possible, you should use a tool such as VLANs to limit the SNMP traffic's visibility. That will help address the issue of any host on the network being able to sniff the SNMP packets and see the community strings.

Remember, the "S" in SNMP stands for "Simple". This is not a robust, secure or particularly scalable technology. While it can be useful for monitoring general network health, I would caution against relying on it for actual management.
0
 
mikebernhardtCommented:
The critical piece of information to worry about is the SNMP read-write string. Anyone who has the read-write string for a device can control that device to the degreee that SNMP will let them. On a Cisco router at least, this essentially means full control- you can change the configuration and everything.

The problem is that SNMP community strings are sent clear-text, so anyone with a sniffer can find the community string and then use it. SNMP v3 isn't, but most versions of Cisco IOS don't support it. What you can do on a Cisco router is use and access list to control who the router will respond to when it receives SNMP packets. In addition, do as PsiCop said and make sure that SNMP traffic isn't even sent or received by untrusted networks such as the Internet. These are essential tasks if you choose to use SNMP.

A string by the way, is a programming term which basically means a line of text.
0
 
net_sec_guruCommented:
Yep, like PsiCop stated, have a separate string for your public and your private. But you can have the same strings for all your devices.

You can also look into using something like AAA on devices (TACACS+ or Radius) as they are supported according to Dell:
http://www1.us.dell.com/content/products/productdetails.aspx/pwcnt_5324?c=us&cs=04&l=en&s=bsd

0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.