I would like to begin using Prime to manage switch and router configurations across our enterprise.
My concern is with security.
The way I understand it is that I must supply Prime with r/w credentials to all of my network devices.
My concern is that once I do this - anyone who gains access to Prime owns my network. This doesn't seem safe.
Of course access to Prime will be limited but I'm worried about those accounts being compromised.
Of course, accounts being compromised would be bad without Prime in the equation but that one portal into the whole network would make it really easy for a bad actor to do damage quickly.
I've asked Cisco (both my SE and TAC) for best practices for this and all they have come up with is the official documentation.
I'm looking for real world use cases.
Is anyone using Prime to manage their infrastructure this way? If so do you have any advice on managing credentials used to control your devices?
Such as:
1. Do you use SNMP or CLI credentials?
2. Do you use local accounts or TACACS accounts?
3. What precautions do you take to minimize risk?
Thank you!
