NTP and SNMP traffic over IPsec or Normal link ?

[MrBeginner]

Hi,

I would like to ask about for ntp and snmp traffic.

We are running hub spoke VPN . Should we carry ntp and snmp traffic over ipsec tunnel?

Should we carry ntp and snmp trffic as normal traffic ( without encrypt ,not using ipsec tunnel) ?

What is the best practice ?

[UdupiKrishna]

There's no straight forward answer to this, because this isn't about best practice, rather your organisation's policies and compliance.

If you feel this traffic shouldn't be inspected by MITM (if the network is compromised), sure you can encrypt them via VPN.

[Kasun Bandara]

This requirement is mostly depends on how you configured things. if you want to send ntp and snmp out of tunnel, you can use SNMPv3. for NTP use authentication. but if you have required processing power, try to use these traffic inside tunnel. 

[Mohammed al Baqari]

Hi,

I remember sometime back reading through cisco doc, they recommended to
keep these of IPSec (you already having hub and spoke). For NTP, it is
definitely a best practice to ensure that all your network is synced
through the same NTP source within your organization (and that source
should be synced from outside). Same for SNMP, if you collector is within
your intranet, there is no point of sending it over internet as this
requires exposure of your SNMP server to internet which is another risk for
inbound (especially if you use traps instead of poll mode).

**** please remember to rate useful posts

[MrBeginner]

Hi All,

Thank. 

I just want to know for security compliance.When i read for doc , i only can find how to secure ntp /snmp (eg, using ACL,V3 snmp..etc) but never mentoon about encrypted traffic or normal traffic. 

So i just want to know what is the best practice for security.

[Kasun Bandara · Accepted solution]

Best practice is to use encrypted traffic as much as possible over public networks. 

And sending traffic over VPN or using encrypted services (such as snmpv3 over snmp v1) is depends on your design and company policy.