SNMP Question

[welcomeccie]

The following command snmp-server host 1.1.1.1 means that it will send the traps to NMS 1.1.1.1 only

Should i use the following too for more security

access-list 50 permit 1.1.1.1

access-list 50 deny any log

snmp-server community CISCORO RO 50

[David Stanford]

It is always good to add that too...it means that only 1.1.1.1 will be able to poll the RO community string of the device.

If you have a RW string I would suggest an ACL on that as well.

[welcomeccie]

But with this command snmp-server host 1.1.1.1 I ensure that the traps will go to that host only so why should i use the ACL with community command and what does Poll the communlty mean?

[David Stanford]

The host command ensures that traps goes to this IP only, but an NMS station can still query the router via the RO comm string.

Any NMS that knows the RO community string can query the device for information. This is why you want an ACL on your RO comm string to limit who can query your router.

Traps are different as they are set from the router...polls are snmpgets and snmpwalks looking for response.

http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/products_command_reference_chapter09186a00801a809e.html#wp1153489