SNMPv3 is the third major SNMP version. It retains SNMPv2c message types while replacing plaintext community-string security with user-based access, integrity checks, hashed authentication, and optional encryption. section 6.3 section 6.3.2
Choose one of three SNMPv3 security levels:
- NoAuthNoPriv provides neither authentication nor encryption. section 6.3.2
- AuthNoPriv provides authentication without encrypting message contents. section 6.3.2
- AuthPriv provides both authentication and encryption and is represented by the Cisco IOS priv group setting. section 6.3.2
Cisco IOS AuthPriv configuration
R1(config)# snmp-server group GROUP1 v3 priv R1(config)# snmp-server user USER1 GROUP1 v3 auth sha AuthPW priv aes 256 PrivPW The first command creates an AuthPriv group; the second assigns USER1 to it with SHA authentication and AES-256 encryption. Traps can then be enabled and an NMS specified with snmp-server enable traps and snmp-server host. section 6.3.2
Table 6.2 SNMP versions (view table figure)
| Version |
Message types |
Authentication |
Encryption |
|---|---|---|---|
| SNMPv1 |
Get, GetNext, Set, Trap, Response |
Community strings |
No |
| SNMPv2c |
Get, GetNext, Set, Trap, Response, GetBulk, Inform |
Community strings |
No |
| SNMPv3 |
Get, GetNext, Set, Trap, Response, GetBulk, Inform |
Hash-based authentication with username/password |
Yes |
Compare SNMPv1, SNMPv2c, and SNMPv3 message types, authentication, and encryption at a glance. section 6.3
