What are the SNMPv3 security levels, and how do you configure SNMPv3 on IOS?
Show the answer
Say this first
Three levels. noAuthNoPriv: a username only, no authentication, no encryption. authNoPriv: messages are authenticated with an HMAC (MD5 or SHA) but sent in clear. authPriv: authenticated and encrypted (DES, 3DES or AES). I use authPriv with SHA and AES. On IOS you create a view, a group that sets the security level and the view, then a user in that group with its authentication and privacy passwords.
Go deeper
Configuration
ip access-list standard SNMP-MGRS
permit 10.0.0.50
!
snmp-server view NMS-VIEW iso included
snmp-server group NMS-RO v3 priv read NMS-VIEW access SNMP-MGRS
snmp-server user nmsuser NMS-RO v3 auth sha Auth-Pass-2026 priv aes 128 Priv-Pass-2026| RFC name | IOS group keyword | Authentication | Encryption |
|---|---|---|---|
| noAuthNoPriv | noauth | no | no |
| authNoPriv | auth | yes | no |
| authPriv | priv | yes | yes |
The security model is USM (user-based, RFC 3414) and access control is VACM (view-based, RFC 3415).
Things that catch people
snmp-server userlines never appear in the running config. Check withshow snmp user.- User keys are localized to the engine ID. Change
snmp-server engineID localand every user stops working until you re-create it. - The group's level is a minimum. A request at authNoPriv against a
privgroup is refused. - net-snmp rejects passphrases shorter than 8 characters.
- Informs over v3 need the manager's engine ID (
snmp-server engineID remote) and the user defined against it with theremotekeyword.
Test from the NMS
snmpget -v3 -l authPriv -u nmsuser -a SHA -A 'Auth-Pass-2026' -x AES -X 'Priv-Pass-2026' 10.255.0.1 SNMPv2-MIB::sysName.0MD5 and DES are weak. SHA with AES-128 is the common baseline, and newer platforms add SHA-2 options.
They will ask next
Someone changed the engine ID and the NMS lost access. Why?
SNMPv3 derives each user's keys from the password and the engine ID. New engine ID, old keys: every request fails authentication. Re-create the users.
Your config backups do not contain the SNMPv3 users. Is the backup broken?
No, IOS keeps them out of the running config by design. Your build scripts or automation must create them, or a restored device comes back with no SNMPv3 access.
Traps
- Saying authNoPriv encrypts. It only authenticates.
- Misreading the IOS keyword.
privon the group means authPriv.