Things that may affect your network reach ability or access control lists or ACLJ and firewall rules
in many networks that aren't actively being managed.
You'll find that security engineers have blocked protocols such as S&P and ICMP those two protocols
are very important.
Network management protocols but for security reasons they may have been blocked in various points in
the network by security conscious engineers.
So it's important that when you starting to audit the network in preparation to a in a mass rollout
that you pay special attention to where traffic is allowed and where it's denied.
Now from a best practice point of view it's ideal to deploy a management villain which is separate to
the veal and used for user traffic.
So a separate network or separate TV Land is created and network management traffic is permitted on
that VLAN so ACLJ and firewall rules on network devices would allow network management protocols on
that VLAN and allow an in a mess to access the loop back of a route as an example.
Just be aware that if you limit access to network devices from only specific IP addresses so as an example
you only allow the IP address of the network management system to access the riders loop back interface
using as an MP when you change things in your network such as expanding the network management applications
you may need to go back and adjust your access lists or adjust your firewall rules.
So it may be simpler to permit a subnet access to your network devices rather than locking it down to
an individual IP address in the same way when discussing security.
You need to pay attention to different security zones.
A customer may have an outside interface on a firewall an inside interface and a DMZ interface on their
firewall.
These security zones can impact your network management systems so you need to understand how you're
going to deploy the enemies and how security rules and firewall zones are going to affect overall reach
ability and the management strategy that you deploy.
Now last but not least you need to think about overlapping and non readable addresses in your network
overlapping and unreadable addresses can be a real headache when deploying network management systems.
You should audit your network and understand which addresses are reachable and from within the network
and take that into account as you start documenting the systems and decide where to rollout your network
management system.
In many cases if you have overlapping address space and you have devices on each of those overlapping
subnets that you need to monitor you'll need to create a separate polling engine for NPM for each duplicate
address space zone.