Solved: SNMP Security on Cisco ASA 5510 - Cisco Community

1354

Views

0

Helpful

4

Replies

I am on a bit of a hotseat right now. I have a Cisco ASA5510 used for b2b vpn connections. Some one from my sales departmet has offered to allow a customer to monitor our vpn device via snmp (with nagios).

I have a major proble with this. Unfortunatly it is gettign stuffed down my throat. I am worried about compromising by gear. We have other customers on this device.

Can someone tell if there is a safe way to do this.

2 Accepted Solutions

Accepted Solutions

Make sure you use a password for snmp authentication and only read is allowed for the MIBS.

Then the monitoring software will only be able to pull information/monitor from the ASA, but not change anything etc.

I hope it helps.

PK

View solution in original post

ASAs are not susceptible to the snmp vulnerabilities that existed in IOS

http://www.cisco.com/warp/public/707/cisco-sa-20010227-ios-snmp-ilmi.shtml#summary

http://www.cisco.com/warp/public/707/cisco-sa-20010228-ios-snmp-community.shtml#summary

I hope it helps.

PK

View solution in original post

4 Replies 4

Make sure you use a password for snmp authentication and only read is allowed for the MIBS.

Then the monitoring software will only be able to pull information/monitor from the ASA, but not change anything etc.

I hope it helps.

PK

I was worried that they would be able to read my configs (similar to a router). Do you know if this is possible ?

Stupid marketing Department. Anything for a sale.

ASAs are not susceptible to the snmp vulnerabilities that existed in IOS

http://www.cisco.com/warp/public/707/cisco-sa-20010227-ios-snmp-ilmi.shtml#summary

http://www.cisco.com/warp/public/707/cisco-sa-20010228-ios-snmp-community.shtml#summary

I hope it helps.

PK

Learn, share, save

Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.

New here? Get started with these tips. How to use Community New member guide

Log in to Community

Review Cisco Networking products for a $25 gift card