SNMP Question

Unanswered Question
Oct 31st, 2007
User Badges:

The following command snmp-server host 1.1.1.1 means that it will send the traps to NMS 1.1.1.1 only


Should i use the following too for more security


access-list 50 permit 1.1.1.1

access-list 50 deny any log


snmp-server community CISCORO RO 50



  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
David Stanford Wed, 10/31/2007 - 07:01
User Badges:
  • Cisco Employee,

It is always good to add that too...it means that only 1.1.1.1 will be able to poll the RO community string of the device.


If you have a RW string I would suggest an ACL on that as well.

welcomeccie Wed, 10/31/2007 - 07:49
User Badges:

But with this command snmp-server host 1.1.1.1 I ensure that the traps will go to that host only so why should i use the ACL with community command and what does Poll the communlty mean?

David Stanford Wed, 10/31/2007 - 10:36
User Badges:
  • Cisco Employee,

The host command ensures that traps goes to this IP only, but an NMS station can still query the router via the RO comm string.


Any NMS that knows the RO community string can query the device for information. This is why you want an ACL on your RO comm string to limit who can query your router.


Traps are different as they are set from the router...polls are snmpgets and snmpwalks looking for response.


http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/products_command_reference_chapter09186a00801a809e.html#wp1153489

Actions

This Discussion