Secure SNMP + WMI?

Question

Hi,

I am setting up NPM and Netflow along with the Network Config product on a bunch of cisco routers and then a couple cisco switches as well as HP switches.

I was wondering what the optimal secure SNMP config is for the devices and then also the safest way to turn on WMI within the lan?  I know WMI is hard to secure, but also necessary, what is the norm?

krfletch · Answer

Hi,

Thanks, I just can't do SNMP on many of our devices, they won't upgrade to newer IOS.

I want to use SNMP 2 and from what I have read using an ACL is the best way, but from there not sure if I should do a RO or RW - I don't plan to configure it using SNMP so RO should be fine, but I want to make sure it is secure.

Yann · Answer

Hi,

I was wondering what the optimal secure SNMP config is for the devices

You should definitely go for SNMPv3 and restrict the rights of the view (View-Based Access Control) to the minimum required by Orion.

The following PDF is listing quite well the pro and cons of the SNMP versions:

Security in SNMPv3 versus SNMPv1 or v2c

also the safest way to turn on WMI within the lan

HTH,

Yann