Hardening SNMP by IPSec

This step-by-step article describes how to configure network security for the Simple Network Management Protocol (SNMP) service in Windows Server 2003.

The SNMP service acts as an agent that collects information that can be reported to SNMP management stations or consoles. You can use the SNMP service to collect data and manage Windows Server 2003, Microsoft Windows XP, and Microsoft Windows 2000-based computers throughout a corporate network.

Communications between SNMP agents and SNMP management stations is typically secured by assigning a shared community name to the agents and management stations. When an SNMP management station sends a query to the SNMP service, the community name of the requestor is compared to the community name of the agent. If they match, the SNMP management station has been authenticated. If they do not match, the SNMP agent considers the request a "failed access" attempt, and may send an SNMP trap message.

The SNMP messages are sent in clear text. These clear text messages are easily intercepted and decoded by network analyzers, such as Microsoft Network Monitor. Community names can be captured and used by unauthorized persoel to gain valuable information about network resources.

IP Security Protocol (IPSec) can be used to protect SNMP communications. You can create IPSec policies to secure communications on UDP ports 161 and 162 to secure SNMP transactions.