Network Monitoring Server - Location?

[jaysoo]

I was wondering where people generally put their monitoring servers running syslog, snmp, netflow etc. Mine are all on inside networks, but I want to be able to monitor Internet routers and I don't want to permit anything from an outside network to an inside network. In that type of situation do you put your servers on a DMZ or permit the traffic to the inside or what? Thanks.

[Marvin Rhoads]

While some caution is good, more isn't always better.

I have typically allowed limited communications from external hosts and devices in to management systems via well defined and understood paths. You can certainly (and probably should) NAT the target and apply the necessary ACLs (with logging that you or your organization actually checks regularly) to ensure that only permitted communications are allowed through your controlled interface.

Hope this helps.