Learn Computer Networking PNETLab - Network Management, SNMP & AAA Security

#Introduction

A network with dozens of routers and switches cannot possibly be monitored one by one through a console. Episode 19 discusses the final layer of operational maturity: how to monitor all devices from a single point, manage user access centrally, and close services that should not be open.

We discuss SNMP for monitoring, AAA with TACACS+ and RADIUS for centralized authentication, then close with hardening practices for Cisco devices. This material bridges your lab with professional network operations standards.

#Simple Network Management Protocol (SNMP)

#The SNMP Manager and Agent Concepts

SNMP has two roles: an agent is the software inside a network device that provides data, and a manager is the server (NMS) that requests and displays that data. The manager sends queries, and the agent answers with metric values such as CPU, memory, and interface status.

Configure SNMPv2c on the router so it can be read by an NMS:

configure terminal
snmp-server community public RO
snmp-server host 192.168.10.100 version 2c public
exit

snmp-server community public RO defines a community string with read-only access — the NMS can read but not change the configuration. The second command directs traps and informs to the NMS address.

#The Advantages of SNMPv3

SNMPv2c sends community strings in plaintext, so anyone watching the packets could hijack access. SNMPv3 adds full encryption and authentication:

configure terminal
snmp-server group NMSGROUP v3 priv
snmp-server user monitor NMSGROUP v3 auth sha Pn3tLab2026 priv aes 256 Pn3tLab2026
exit

snmp-server user monitor NMSGROUP v3 auth sha ... priv aes 256 ... creates an SNMPv3 user with SHA authentication and AES encryption. All SNMP communication is now encrypted, eliminating the risk of reading community strings off the wire.

#Authentication, Authorization, Accounting (AAA)

#Centralized Management Security via TACACS+ or RADIUS

AAA is a three-layer framework: Authentication verifies identity, Authorization determines access rights, and Accounting records activity. Two protocols carry it:

• TACACS+: Cisco-owned, encrypts the entire payload, separates the three AAA functions, and supports granular per-command authorization. A common choice for managing network devices.
• RADIUS: an open standard that combines authentication and authorization, more commonly used for user access such as Wi-Fi.

Basic AAA configuration with TACACS+:

configure terminal
aaa new-model
tacacs server TACACS-SRV
 address ipv4 192.168.10.100
 key Pn3tLab2026
exit
aaa authentication login default group tacacs+ local
aaa authorization exec default group tacacs+ local

aaa new-model enables AAA, then login and exec authorization are directed to the TACACS+ server with a fallback to the local database. If the server dies, administrators can still log in via local.

#Cisco Device Security Hardening

#Disabling Unused Services

A router's attack surface is as large as the number of open services. Turn off the services you do not use:

configure terminal
no ip http server
no ip http secure-server
no cdp run
exit

no ip http server and no ip http secure-server turn off the web management interface, while no cdp run disables CDP (Cisco Discovery Protocol), which sends device information to every neighbor. The information collected by CDP is a goldmine for attackers on a local network.

#Other Services You Must Check

Besides HTTP and CDP, also audit no ip bootp server, no service tcp-small- servers, and disable Telnet with transport input ssh (episode 2). Get into the habit of a hardening checklist: every open service must have a clear reason, and the rest are closed.

#Building a Management System in PNETLab

Build one router and one Docker Linux server acting as both the NMS and the TACACS+ server. Configure SNMP on the router, run snmpwalk from the NMS to read OID values, then test AAA by logging in via TACACS+. This exercise connects all of episode 19's concepts into a single complete operational flow.

#Closing

Key takeaways:

• An SNMP manager reads data from an agent; the NMS is the monitoring center.
• An SNMPv2c RO community can only read; SNMPv3 adds encryption.
• AAA = authentication, authorization, and accounting.
• TACACS+ is fully encrypted and granular; RADIUS is an open standard.
• no ip http server and no cdp run close unused services.
• Get into the habit of a hardening checklist on every new device.

In the next episode, episode 20, we summarize the entire series in one big project: complex enterprise lab & comprehensive troubleshooting — designing a complete multi-site topology with VLAN trunking PortFast, core switches with SVI EtherChannel and HSRP, a WAN edge with multi-area OSPF and eBGP to an ISP, a branch GRE over IPsec VPN, and a layer-by-layer troubleshooting methodology with the CLI verification commands you must master.