topic Re: HP SIM 4.x and SNMP version 3 in Server Management - Systems Insight Manager

HP SIM 4.x and SNMP version 3

MC1903 — Fri, 18 Jun 2004 10:03:15 GMT

Hi,

Does anyone know if HP SIM 4.x is compatible with SNMP v3, on any of the supported OS platforms?

My customer requires the additional security features it provides and will not use SNMP v1 or v2 in their production environment.

Cheers

Martin

Re: HP SIM 4.x and SNMP version 3

David Claypool — Fri, 18 Jun 2004 11:01:32 GMT

The short answer is that neither the agents nor hpSIM support SNMP v3. Our long term direction is to move away from SNMP in favor of WBEM/WMI.

While SNMP has a bad reputation as being an "insecure" protocol because it communicates in clear text (including the "community string" handshake that is required), hpSIM uses it only to collect data and send events. The presence of SNMP in an environment does not constitute any additional risk just by its presence. I would bet that the same customer who "refuses to deploy SNMP" is not aware that it is already used extensively by his network infrastructure people on that very same network.

Re: HP SIM 4.x and SNMP version 3

MC1903 — Fri, 18 Jun 2004 11:14:19 GMT

Many thanks for that David.

For another 10pts..

1) Any idea how far away this move is?

2) I assume WBEM & WMI communications occur over SSL (HTTPS)?

Cheers

Martin

Re: HP SIM 4.x and SNMP version 3

David Claypool — Fri, 18 Jun 2004 11:33:54 GMT

hpSIM already has the capability; the agents have to be re-architected, and that isn't expected until sometime in 2005.

"Pure" WBEM is formatted as XML over HTTPS; WMI is an "implementation" of an object manager and uses DCOM.

Re: HP SIM 4.x and SNMP version 3

MC1903 — Fri, 18 Jun 2004 11:43:03 GMT

Once again, many thanks. You are a star!

Re: HP SIM 4.x and SNMP version 3

Alain Staelen — Thu, 24 Jun 2004 12:49:18 GMT

Another (non-free) solution could be to use Openview Operations for Windows.

This would allow the Operations for Windows agents running on each managed server to locally pick up the "unsecure" SNMP info from the servers and deliver them securely to a central console.

I'm looking into this possibility for the moment.