If your network is spread out across a wide area with many unmanned sites, you need an SNMP monitoring system. It's virtually impossible for you and your team to watch all of your gear without some form of automated monitoring.
SNMP monitoring is distinct from other forms of monitoring because it uses the Simple Network Management Protocol(SNMP)l. SNMP messages are, most commonly, created by an SNMP agent (some kind of gear at your site). And they are received by a central SNMP manager (a software program, ideally running on its own dedicated hardware platform).
This protocol is one of the most popular in the remote monitoring word today because it can bring you many benefits. And there really aren't any significant disadvantages to be wary of.
Of course, using this popular protocol isn't without some threats. Anytime you use something that is common, there will be a larger population of people who are familiar with it.
Some of these people may have ill intent. They might use the common knowledge of SNMP to break into your system. There are strong cyber terrorism issues here.
For many years, the lack of security in SNMP was viewed by many as its Achilles' heel. For all its wonderful business benefits, the threat of cyber terrorists and virtual vandals loomed large.
However, SNMP monitoring is no longer without any defenses. SNMP community string is a common security feature in SNMP devices. And there are also some other SNMP security best practices that you should know about.
SNMP community string is an SNMP security password that devices need to talk to each other. It's similar to a user id or password that allow you to access your equipment's data.
Your SNMP monitoring device should send the community string along with SNMP requests. If the community string is correct, then your device will answer with the requested information. However, if the community string is incorrect, your device will simply disregard the request and will not respond.
There are three different kinds of community string:
Although the community string does offer some security, it's only used by devices that support the versions SNMPv1 and SNMPv2.
SNMPv1 was the first version of SNMP. It is an open, standard protocol, but still lacked key areas for certain applications. Later versions have addressed many of these problems. Smaller RTUs commonly support SNMPv1..
SNMPv2c is a sub-version of SNMPv2. Its key advantage over previous versions is the Inform command. Unlike Traps, which are simply received by a manager, Informs are positively acknowledged with a response message. If a manager does not reply to an Inform, the SNMP agent will resend it.
Other advantages of SNMPv2c include:
Not all devices are SNMPv2c compliant, so your SNMP manager should be downward compatible with SNMPv1 devices. You can also use SNMPv3 mediation devices to ensure compatibility.
Another point to remember is that SNMPv1 and v2c equipment have their default community string set to "public." So, you'll have to change all of your community strings to customized values during the device setup.
Now, SNMPv3 is the newest version of the SNMP protocol. Its primary feature is enhanced security.
The "EngineID" Identifier in SNMPv3 uniquely identifies each SNMP entity. Conflicts can occur if two SNMP entities have duplicate EngineIDs. The EngineID is used to generate the key for authenticated messages.
SNMPv3 security comes primary in two forms:
SNMP community strings do offer you some security, but the best practice is to have encrypted SNMPv3.
SNMPv3 support is a standard feature of the NetGuardian 832A G5 RTU. This allows you to monitor all of your SNMP devices with enhanced security via message encryption. The NetGuardian allows you to report alarms in SNMP v1, v2c, or v3. This leverages the full NetGuardian feature set and your existing SNMP management station.
The NetGuardian 832A G5 provisioning tools allow you to set up advanced SNMPv3 applications. For example, you can choose which SNMP versions managers may use to communicate with your NetGuardian. By restricting your managers to v3 only, you're requiring them to use that protocol's enhanced security. In environments where security is less of a concern, you can allow all SNMP versions to maximize flexibility.
This RTU also automatically generates a unique EngineID to eliminate conflicts caused by duplicate IDs. You can modify your NetGuardian's default v3 EngineID for advanced SNMP applications, but this is recommended only for experienced users.
Using SNMPv3, the NetGuardian 832A encrypts its messages with CBC-DES encryption, a part of the Universal Security Model (USM). The encrypted data appears scrambled if it is intercepted, rendering it unreadable by anyone but the intended recipient. This makes SNMPv3 your best option when routing SNMP messages over the Internet.
This is ideal for companies with mission-critical infrastructure requiring high security. Even on a secured network, SNMPv3 encryption will provide an additional layer of redundant security.
Also, the 832A supports unique security profiles for up to four users. Each user can be assigned a unique set of security parameters, including authentication and/or privileged access to SNMP.
To learn more fundamental SNMP protocol concepts, just download your free copy of The Fast Track Introduction to SNMP.
This white paper is a quick and easy (but solid and foundational) introduction to SNMP. It has been created to give you the information you need to successfully implement SNMP-based alarm monitoring in your network. It's an introduction to SNMP from the perspective of telecom network alarm management.
Summarizing the history and structure of the protocol you'll see some concrete applications for using SNMP in internal network alarm environments. You'll also see diagrams and read plain-English descriptions that teach you the basics in an intuitive way.
And don't hesitate to call one of our SNMP experts to ask a specific question, though. We can offer basic guidance as you learn SNMP, even if you don't need to purchase any new equipment.