Help with network management security

[oneirishpollack]

Hi All,

Our organization has one  server running Quest Foglight NMS. It collects and manages primarily network devices (Cisco) at six different campuses.

There are approximately 130 devices total. The network devices are all addressed using a 192.168.x.x, with the third octect reflecting the site.

All of the traffic from these subnets are then passed back to the collector through individual site-to-site VPN tunnels. Does this seem like a safe and reasonable way to operate? Any suggestions, feedback, or concerns I should think about?

[ngoldwat · Accepted solution]

Off the top of my head,  here are two ideas:

1)  Restrict management traffic to it's own vlan

2)  Use SNMPv3 wherever possible

[oneirishpollack]

Thank you for taking the time to reply.