Multiple SNMP community strings possible on ASA ?

[deepak.chaudhary31]

Hello Guys - We are monitoring our client's ASA firewalls (various 7.x versions) using snmp v2 configuration.

Our monitoring servers are sitting behind management interface of devices.

A new requirement has come up where another company will need to monitor these devices and hence needs their monitoring servers to be configured for SNMP on these devices.

A simple way to do this could be just use same snmp community string for adding their devices and share the string with them.

What I am looking to check is whether this its possible to have a new community string configured for their servers while our current servers and their config on FW remains intact?

thanks

[Marvin Rhoads · Accepted solution]

Sure, just specify their unique community string when you add their management station as an authorized SNMP system. See Step 6 here.

You could also require them to use SNMPv3 with unique authentication and encryption passwords.

[deepak.chaudhary31]

Cheers Marvin.

Just had a look on the article and point 6. We have a community string (masked) written in Community String (Default) so as per the link you gave me - If I chose a new string while adding a new snmp server of that company - ASA will consider that string and not the one which is in Community String (Default). Please confirm.

Another thing - I discovered that version 7.2 doesn't support snmp v3. Is that correct ?

[Marvin Rhoads]

Hello Deepak,

Yes, that's how I understand it. I don't have one handy at the moment to test this behaviour but that is my understanding of the documentation.

SNMP v3 support was introduced in ASA software version 8.2(1). Reference.