A community string is a shared, password-like value that authenticates SNMPv1 and SNMPv2c operations between an NMS and managed device. SNMPv1 and SNMPv2c send it in plaintext, so it provides limited security rather than encryption. section 6.3 section 6.3.2
Use community strings to control which SNMP operations an NMS may perform:
- Read-only (RO) permits Get, GetNext, and GetBulk requests but rejects Set requests. section 6.3.1
- Read-write (RW) permits both reading with Get-family requests and modifying the device with Set. section 6.3.1
- An ACL can restrict each community string to permitted NMS sources. section 6.3.1
- SNMPv3 replaces community strings with users, integrity checks, optional authentication, and optional encryption. section 6.3.2
Cisco IOS configuration
R1(config)# snmp-server community password123 RO R1(config)# snmp-server community password456 RW These commands allow Gets using either string, but allow Sets only with password456. To send notifications, enable traps and identify the NMS: R1(config)# snmp-server enable traps R1(config)# snmp-server host 192.168.1.10 version 2c password789 section 6.3.1 section 6.4
Table 6.2 SNMP versions (view table figure)
| Version |
Message types |
Authentication |
Encryption |
|---|---|---|---|
| SNMPv1 |
Get, GetNext, Set, Trap, Response |
Community strings |
No |
| SNMPv2c |
Get, GetNext, Set, Trap, Response, GetBulk, Inform |
Community strings |
No |
| SNMPv3 |
Get, GetNext, Set, Trap, Response, GetBulk, Inform |
Hash-based authentication with username/password |
Yes |
Compare SNMPv1, SNMPv2c, and SNMPv3 by message types, authentication method, and encryption support. section 6.3
