I'm sorry if I didn't understand your query completely, but I'll try my best to answer:

 

(1) From the FAQ in IT Assistant User Guide:

 

http://support2.jp.dell.com/docs/software/smitasst/8.0/en/ug/faq.htm#52963

( Check the answer to the question: "Can I use IT Assistant over the Internet?")

 

 

(2) Could you also check whether you really want to use IT Assistant across the Internet? If you keep the ITA system in your remote LAN itself (where all your servers are located), your entire SNMP communication will be restricted there and it will avoid communication across an unsecured Internet, and you will avoid opening SNMP related ports in your main LAN firewall.

Or, could you do by just accessing the ITA UI over  the Internet, using your secured tunnel etc? (I might be wrong here 'coz I don't have complete picture of your tunnel and its security).

Just in case you haven't noticed: ITA's web-browser based UI communicates with the ITA Management station occurs over HTTPS.

 

Yes I saw the portion of the FAQ, but it didn't provide any "detailed info". 

 

I'm not just trying to access the IT Assistant console over the INTERNET.  The issue is that many of our servers are located on an external segment.  The IT Assistant console is on the local LAN.  Between the internal LAN and the external segment, there is a secure tunnel going "into the the external site" but coming back, traffic is routed back using external public addresses.

 

On the LAN the firewall allows SNMP traffic from the external site to come back into the LAN, the snmp packets are forwarded to the IT Assistant box on the LAN. 

 

If we had a leased line private connection to the external site, or a 2-way tunnel, VPN -anything fully secure this wouldn't be much of an issue.

 

So i was trying to get a feel for how "exposed" vital information could be (snmp) in our setup if the IT Assist box monitored servers at a remote location with the secure tunnel going into that site, and then the snmp traps coming back from those servers on the remote segment are then routed across the INTERNET back to the IT Assist box. 

I have everything setup but I have not enabled monitoring until i can get more information on the possible security risks involved.

 

I'm new at the company and therefore not 100% sure about the connection to the remote site.  All production servers are actually located at a COLO (the external site) which makes those the most important pieces of equipment to be managed. 

 

I would have expected that there be a totally secure (VPN, dedicated leased line etc.) in place between the main office LAN and the remote site, wouldn't you if that's where all of the prod servers are located?  It's a weird setup.

 

I don't even understand how there is a supposedly secured tunnel setup to access the remote servers at the COLO but yet the OCLO machines cannot talk back to the LAN in a similar (secure tunnel) fashion?  It makes no sense. 

 

In other words you can hit a COLO server from the LAN using a private address but you cannot hit a server / machine back at the LAN from the COLO using a private address.  It's only from the LAN into the COLO where you can talk to the external remote COLO site using a private address not the other way around.  That's weird isn't' it?  Makes no sense. 

 

Supposedly also even though the COLO can only talk back to the LAN using public addresses, the route taken back from the COLO to the LAN is not across the public INTERNET -but also not a secure tunnel either (otherwise if it were a secure tunnel it would use all private addresses), something like from the COLO back to the LAN uses public addresses but the path stays within the telco "(ISP's) network and not across the Internet.  All servers in the COLO are accessible form the INTERNET which makes me doubt that the path from the COLO to the LAN using public addresses does NOT traverse the public INTERNET. 

 

We need a better connection to the remote site (COLO) asap in my opinion since everything is manged (COLO servers are all production) from the LAN, mapping drives, TS sessions etc. and now that I'm implementing snmp monitoring.  Otherwise right now rather than sending snmp traps to the IT Assist box from the COLO back into the LAN, I'd rather stick a separate IT Assistant console out at the COLO and keep all of that traffic local to the COLO since it's not a secure connection back to the main LAN from the COLO.

 

I know this is a lot and i prob seem to be repeating myself but do you think from what i have explained that sending snmp traps from the remote site into the LAN would be a risk?  It seems if snmp v3 were being used it would then be safe?  But is snmp v3 available for use with 2003 Server and IT Assistant (OpenManage Components)?

 

Thanks for any extra info!

I think ITA 8.0 supports SNMP trap format of v1 only so you would not have any security offered by the SNMP protocol itself( a sniffer on the n/w can decipher all the SNMP v1 trap and other packet information.)

 

I am not sure whether you thought of this, but you could have another instance of ITA running on the remote location and then use the browser based secure UI to connect to the remote ITA and use it for monitoing the remote servers.

I would agree with sysbuff. Don't send unsecured traffic across the internets. If you post something cleartext on the net you don't own it anymore. Those are the rules. You should not be concerned with anything else. Don't send cleartext across the net.

 

You need to get a handle on your VPN situation more than your monitoring in my opinion. Your security should be coming before monitoring. There are a million products out there for running a vpn connection or tunnelling all of your traffic. Have you looked in to doing all of this with IPsec on your windows boxes? It takes a little time to learn but it is worth it. You can build your own firewalling with ipsec and encrypt specific ports etc... Just start with preshared key before you try kerb/ad. It will make the process easier.

 

One of the big advantages ITassistant provides you with is the ability to sort your machines into groups then run comparisons of firmware/drivers with ones you download into the ITassist database. This process is not very secure and can't be done over the internet unless you would really like somebody else to admin your machines for you. It needs to be done behind a firewall. It is a sweet tool for keeping up to date or just running reports to update later with the Openmanage Server Update CD.

 

Someday maybe Dell will use SNMP v3. Maybe someday they will stop requiring a broad range of RPC ports to be open to run updates. For now if you want to use this free product you have to come up with a creative solution that fits your location. I script IPSec firewall rules to export current, import locked down ones, then run schedulded update packages and put ipsec rules back and turn the firewall back on when finished. It is overcomplicated but my machines are not exposed at all. All SNMP traffic is locked down with both firewall and IPSec to my ITAssistant box and the individual server in all cases.

Thanks for the info.  I was afraid that v1 was all that was avail for use with ITA. 

 

I know the connection to the remote location is horrible, I'm new at the company.  It's something I am not used to.  Funds are limited though (I know , that shouldn't matter, you shouldn't run an info system if you can't secure it period)...

 

Simply putting an ITA machine up at the remote location would be fine (use https: to log into the console remotely) but that's not an option either. 

 

Thanks again for the insight everyone!