SNMPv3 global credentials ?

[JeremySG]

Hello,


We were formerly using SNMPv2 on network devices but we are switching to SNMPv3.
For SNMPv2, there are "global scanning credentials" available.
For SNMPv3, I didn't find global credentials, you have to create your own credentials and map them yourself.

My problem is that we have more than 4000 network devices and they are all in different subnets.
Also, there is no option to map credential for to an Asset Group or to multiple single IP at a time
So i would have to map 4000+ credentials manually, one by one ...

Is there a way to use SNMPv3 credentials as global scanning credentials ?

Thanks a lot
Jérémy

[rom]

way too late, but you can make an all-encompassing IP range that covers every subnet you have, and map the credential to it.

[JeremySG]

Rom wrote:
way too late, but you can make an all-encompassing IP range that covers every subnet you have, and map the credential to it.

Hi Rom,

Yes I thought about it too but the thing is that we have around 40 000 subnets in total and if we scan them all, each pingable IP will be considered as an asset and will cost 1 license
I'm also not sure how long this would take.


Thanks
Jeremy

[rom]

If you make a huge subnet, like HUGE - it will mark it as red in the scanning targets with a question mark - which you hover over and it says 'it will take X days to scan this' - I also named it 'DO NOT ENABLE OR SCAN'

JeremySG wrote:

Rom wrote:
way too late, but you can make an all-encompassing IP range that covers every subnet you have, and map the credential to it.

Hi Rom,

Yes I thought about it too but the thing is that we have around 40 000 subnets in total and if we scan them all, each pingable IP will be considered as an asset and will cost 1 license
I'm also not sure how long this would take.


Thanks
Jeremy

[JeremySG]

Rom wrote:
If you make a huge subnet, like HUGE - it will mark it as red in the scanning targets with a question mark - which you hover over and it says 'it will take X days to scan this' - I also named it 'DO NOT ENABLE OR SCAN'

JeremySG wrote:

Rom wrote:
way too late, but you can make an all-encompassing IP range that covers every subnet you have, and map the credential to it.

Hi Rom,

Yes I thought about it too but the thing is that we have around 40 000 subnets in total and if we scan them all, each pingable IP will be considered as an asset and will cost 1 license
I'm also not sure how long this would take.


Thanks
Jeremy

Oh ok, maybe I missunderstood something : you are saying that this could work even without scanning the subnet ? Just by creating it the scanning targets ?

In this case, it would be very helpful

Thanks

[rom]

Yup! go ahead and make a ridiculously large subnet, don't enable it, and attach all those tons of creds you need. Since I have a kabillion subnets as well, I actually don't enable scanning outside of the first discovery... then i just leave them off... and I have never enabled the large one obviously.


Don't worry, if you accidentally enable it when you make the IP range, you can easily disable it and clear scanning queue... but I keep reminding myself, the range doesn't matter as it chugs along at whatever limit you told it to go at... it simply just queues up a bunch of addresses.

[ErikT]

Hi JeremySG,

You can create different sets of SNMP(v3) credentials and map these to your IP range scanning targets.
Unfortunately, there is no option for setting global SNMP(v3) credentials.

I added your topic to the wishlist item though.