Solved

Comunity string question.

Posted on 2004-09-07
3
290 Views
Last Modified: 2010-04-17
I am going to be installing SNPM on 10 Servers, 2 Dell GB Managed Switches and 2 Dell Managed Fast Ethernet Switches.
I am new at this and have a few questions.

Should it also be installed on the Router providing WAN access to our other sites?

Question about the community string, I understand it is like a password. I think of a string as a line between 2 objects. Can I create a single string (password) for all the devices, or do I need 1 per device?

Urgent...

Thanks in Advance… Michael
0
Comment
Question by:Linux_Hawk
3 Comments
 
LVL 34

Accepted Solution

by:
PsiCop earned 200 total points
Comment Utility
Most folx use one SNMP community string for read access on all devices, and a different one for Read-Write. Whether or not you should use a different R/W community string on each device is something only you can answer - depends on the importance of security in your environment. But then if security were a critical concern, you wouldn't be using SNMP, since its fairly insecure.

Do make sure SNMP traffic is not permitted outside your network to the Internet. If possible, you should use a tool such as VLANs to limit the SNMP traffic's visibility. That will help address the issue of any host on the network being able to sniff the SNMP packets and see the community strings.

Remember, the "S" in SNMP stands for "Simple". This is not a robust, secure or particularly scalable technology. While it can be useful for monitoring general network health, I would caution against relying on it for actual management.
0
 
LVL 28

Assisted Solution

by:mikebernhardt
mikebernhardt earned 200 total points
Comment Utility
The critical piece of information to worry about is the SNMP read-write string. Anyone who has the read-write string for a device can control that device to the degreee that SNMP will let them. On a Cisco router at least, this essentially means full control- you can change the configuration and everything.

The problem is that SNMP community strings are sent clear-text, so anyone with a sniffer can find the community string and then use it. SNMP v3 isn't, but most versions of Cisco IOS don't support it. What you can do on a Cisco router is use and access list to control who the router will respond to when it receives SNMP packets. In addition, do as PsiCop said and make sure that SNMP traffic isn't even sent or received by untrusted networks such as the Internet. These are essential tasks if you choose to use SNMP.

A string by the way, is a programming term which basically means a line of text.
0
 
LVL 4

Assisted Solution

by:net_sec_guru
net_sec_guru earned 100 total points
Comment Utility
Yep, like PsiCop stated, have a separate string for your public and your private. But you can have the same strings for all your devices.

You can also look into using something like AAA on devices (TACACS+ or Radius) as they are supported according to Dell:
http://www1.us.dell.com/content/products/productdetails.aspx/pwcnt_5324?c=us&cs=04&l=en&s=bsd

0

Featured Post

Control application downtime with dependency maps

Visualize the interdependencies between application components better with Applications Manager's automated application discovery and dependency mapping feature. Resolve performance issues faster by quickly isolating problematic components.

Join & Write a Comment

It happens many times that access list (ACL) have to be applied to outgoing router interface in order to limit some traffic.This article is about how to test ACL from the router which is not very intuitive for everyone. Below scenario shows simple s…
Problem Description:   Couple of months ago we upgraded the ADSL line at our branch office from Home to Business line. The purpose of transforming the service to have static public IP’s. We were in need for public IP’s to publish our web resour…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now