Things that may affect your network reachability are access control lists or ACLs and firewall rules.
In many networks that aren't actively being managed, you'll find that security engineers have blocked
protocols such as SNMP and ICMP.
Those two protocols are very important network management protocols, but for security reasons, they
may have been blocked in various points in the network by security-conscious engineers.
So it's important that when you're starting to audit the network in preparation to a NMS rollout that
you pay special attention to where traffic is allowed and where it's denied.
Now, from a best practice point of view, it's ideal to deploy a management VLAN which is separate
to the VLANs used for user traffic.
So a separate network or separate VLAN is created and network management traffic is permitted on that
VLAN.
So ACLs and firewall rules on network devices would allow network management protocols on that VLAN
and allow an NMS to access the loopback of a router
as an example, just be aware that if you limit access to network devices from only specific IP addresses.
So as an example, you only allow the IP address of the network management system to access the routers
loopback interface using SNMP.
When you change things in your network, such as expanding the network management applications, you
may need to go back and adjust your access lists or adjust your firewall rules.
So it may be simpler to permit a subnet access to your network devices rather than locking it down to
an individual IP address.
In the same way, when discussing security, you need to pay attention to different security zones.
That customer may have an outside interface on a firewall and inside interface and a DMZ interface
on their firewall.
These security zones can impact your network management systems.
So you need to understand how are you going to deploy the NMS and how security rules and firewall
zones are going to affect overall reachability and the management strategy that you deploy. Now
last but not least, you need to think about overlapping and non-routable addresses in your network.
Overlapping and unreadable addresses can be a real headache when deploying network management systems.
You should audit your network and understand which addresses are reachable and from where in the network
and take that into account as you start documenting the systems and decide where to roll out your network
management system.
In many cases, if you have overlapping address space and you have devices on each of those overlapping
subnets that you need to monitor, you'll need to create a separate polling engine for NPM for each
duplicate address space zone.