topic SNMP Question in Network Security

SNMP Question

welcomeccie — Fri, 21 Feb 2020 09:45:16 GMT

The following command snmp-server host 1.1.1.1 means that it will send the traps to NMS 1.1.1.1 only

Should i use the following too for more security

access-list 50 permit 1.1.1.1

access-list 50 deny any log

snmp-server community CISCORO RO 50

Re: SNMP Question

David Stanford — Wed, 31 Oct 2007 14:01:49 GMT

It is always good to add that too...it means that only 1.1.1.1 will be able to poll the RO community string of the device.

If you have a RW string I would suggest an ACL on that as well.

Re: SNMP Question

welcomeccie — Wed, 31 Oct 2007 14:49:12 GMT

But with this command snmp-server host 1.1.1.1 I ensure that the traps will go to that host only so why should i use the ACL with community command and what does Poll the communlty mean?

Re: SNMP Question

David Stanford — Wed, 31 Oct 2007 17:36:03 GMT

The host command ensures that traps goes to this IP only, but an NMS station can still query the router via the RO comm string.

Any NMS that knows the RO community string can query the device for information. This is why you want an ACL on your RO comm string to limit who can query your router.

Traps are different as they are set from the router...polls are snmpgets and snmpwalks looking for response.

http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/products_command_reference_chapter09186a00801a809e.html#wp1153489