How to use SIM to monitor servers outside our own network

[G. D. van Kuilenburg]

Hi All,

I work for a small company that provides network management service for several other small (<50 users) companies. Several of our clients run HP Proliant Servers.
On our own server I've installed SIM 5.0 for management purposes. Now I would like to receive certain events (imminent hardware failures for example) from our clients servers within SIM as well.
How should I configure SIM, our firewall and our clients'servers. I don't need complete management capabilities. Just the possibility to receive events.

Thx

[G. D. van Kuilenburg]

No Ideas?

[Albert Austin]

Why dont you use email alerts/notifications?
You probably need your client exchange/mail server to forward email notifications to your email address.

I have that setup and I seem to be able to keep up with all neccessary events.

YOu could also setup pager/sms notification.

[G. D. van Kuilenburg]

Ok, that's in idea. It should be a lot easier to set up, too. Is there any way to send test events, this way?

[Albert Austin]

You could test by sending SNMP traps and see if the are delivered the way you have set it up. Or just create mock failure.

[Mark Matthews]

Hi there, sorry to butt in!
I am looking at setting this up for my company too (and our 50 or so clients)

Wouldn't we need to setup another SIM server at each client site in order to send email notifications about other servers onsite that have a problem?
How would it work sending between the clients SIM server and ours?

Thanks
Mark...

[Alex Whittaker]

i implimented this at a place i used to work at. what you need to do is open UDP 161 on all the internal and external firewalls to allow SNMP traffic from your HP SIM server. we had all servers running from behined cisco PIX Firewalls. all the servers had static ip addresses. you will also need to open tcp port 2381 as well as ping. what you will have to do is then do a manual descovery on the HP sim server with the public ip addresses of the external servers. this is best done to only check for the hardware. if you do software version control i would imagen a lot of internet traffic.

[john juanny]

What about the security risks of sending SNMP packets across the INTERNET (no VPN or tunnel), aren't the Community Names displayed in each packet (in clear text)?

I'm not sure on the details of this myself which is why I'm bringing this up. I'm not even sure of the version of SNMP which is now standard on 2003 Server (is it SNMP v3 which may include encryption versus v1 and v2) ?

Can someone please shed some light on the potential risks of having remote servers communicating with the SIM console across an "open" public connection?

Thanks!

[Don Bitters]

On your firewalls, just limit where 161 can be used from, like your public range from your main office, so even if someone ends up stumbling over your community name, it won't do them any good.

[Alex Whittaker]

I setup the external firewall to only allow SNMP packets from a single IP address. This address was from the SIM server. we also changed the default string