> For the complete documentation index, see [llms.txt](https://help.highlight.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.highlight.net/functionality/highlight-security-considerations.md).

# Highlight Security Considerations

## Overview

This page explains how Highlight offers layers of security to mitigate any risk of granting SNMP write access to a device, and addresses security associated with the use of poller agents.

## Security associated with SNMP Write access

In order for Highlight to produce Performance statistics on latency, packet loss and jitter Highlight uses the built-in ipSLA test feature of Cisco IOS or RPM for JunOS.

Highlight must use SNMP Write access to provision, modify and delete these tests. Since 'Write' access can represent a security problem, Highlight imposes multiple layers of security to ensure that the granted Write access is used safely and cannot affect router operation.

The following describes how security is provided when using SNMP Write access, in additional to that described in the previous section:

{% stepper %}
{% step %}

## Access-list restriction

Access-list restriction is applied on the router which only allows it to accept SNMP requests from the Poller Agents' IP Addresses.
{% endstep %}

{% step %}

## SNMP Write access password

SNMP Write access is restricted by a pre-shared authentication password, separate to the Read password.
{% endstep %}

{% step %}

## SNMP Write access limited to IPSLA or RPM MIB

SNMP Write access is limited, by configuration statements on the router, to the specific MIB used in IPSLA or RPM. This is a very small branch of the MIB tree within the device, and means that Highlight can only change parameters relating directly to IPSLA/RPM tests (for provisioning of tests etc. as described above). Access to all other parts of the device and MIB remains Read Only, so no other functions of the router can be altered.
{% endstep %}
{% endstepper %}

## Security associated with use of Poller Agents

The following describes how Highlight's platform provides security for SNMP access from the poller agent, specifically when located on customer premises.

{% stepper %}
{% step %}

## Outbound-only traffic

A poller run inside the customer's private network is only capable of initiating outbound traffic. There are no listening ports opened by Highlight.
{% endstep %}

{% step %}

## Firewall access

The poller is located behind the customer's firewall and requires no special access through the firewall. The only traffic will be TCP 443 outbound.
{% endstep %}

{% step %}

## Encrypted traffic

All traffic between the Agent and the main Highlight platform is encrypted using the HTTPS protocol.
{% endstep %}

{% step %}

## Device access-list restriction

Access-list restriction is applied on the devices monitored by Highlight, which only allows only SNMP requests from the poller's internal IP Address.
{% endstep %}

{% step %}

## SNMP Read-Only access password

SNMP Read-Only access is restricted via the SNMP community string – this is a pre-shared authentication password.
{% endstep %}
{% endstepper %}

## Related

* [Details of SNMP commands needed for Highlight](https://help.highlight.net/device-setup/complete-snmp-configuration)
* **Architecture**


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.highlight.net/functionality/highlight-security-considerations.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.