Tavve zoneranger User Manual page 90

Community string conventions are best suited for management applications that can be configured
to send SNMP requests for all managed devices to a single address 10 . The primary advantage of
community string conventions is that there is no need to install a GVI driver, an RGVI client, or a
SOCKS shim on the management application server. The three-part community string format (e.g.
) is also useful when managing networks with overlapping
community@ZoneRanger@device
addresses. The primary disadvantage is that the management application must be configured in an
atypical way in order to use the proxy. Some management applications require unique addresses for
each managed device, and do not support the concept of a common proxy address. In these cases, an
alternative SNMP proxy mechanism will need to be selected.
SNMPv3 Conversion
The ZoneRanger SNMP Proxy service can be used to proxy SNMPv1 and SNMPv2c requests to
managed devices. In addition, ZoneRanger can be configured to translate SNMPv1 or SNMPv2c
requests to SNMPv3 requests, as illustrated in the following figure.
This feature enables authentication and encryption of SNMP messages in firewall-partitioned
networks, such as a DMZ, where enhanced security is arguably most needed, while avoiding the
need to configure or upgrade existing management applications to support SNMPv3. SNMPv3
conversion can be configured on a per-device basis, so that the additional administrative effort
required for SNMPv3 can be limited only to those devices where security is most needed.
It is recommended that SNMPv3 users change the authentication and encryption passwords
associated with management devices on a regular basis. To facilitate this, the ZoneRanger web
interface includes a tool for automatically updating SNMPv3 passwords on managed devices. This
tool is located on the Administration > SNMP page SNMPv3 Passwords tab of the ZoneRanger
web interface.
10 Community string conventions can also be used when the management application uses different
addresses for different target devices. However, the GVI/RGVI, SOCKS, or IP address aliasing
mechanisms are likely to be preferred in such cases, because the need to configure special community
strings for each device is eliminated.
ZoneRanger 5.5 User's Guide 90