In which configuration mode is snmp-server community [string] [ro|rw] used?

The snmp-server community [string] [ro|rw] command is entered in Global Config mode on Cisco IOS devices.

SystemGlobal Config

snmp-server community [string] [ro|rw]

Configures an SNMP community string on a Cisco IOS device to allow SNMP access with read-only or read-write privileges for network monitoring and management.

Definition: snmp-server community [string] [ro|rw] is a Cisco IOS global config command. Configures an SNMP community string on a Cisco IOS device to allow SNMP access with read-only or read-write privileges for network monitoring and management.

Overview

The `snmp-server community` command is a fundamental configuration on Cisco IOS devices that defines an SNMP community string, which acts as a password or authentication key for SNMP access. SNMP (Simple Network Management Protocol) is the backbone of network monitoring, enabling management stations like SolarWinds, PRTG, or Cisco Prime to poll device statistics, receive traps, and even modify configurations. This command is critical because without a community string, SNMP access is denied, leaving the network blind to performance issues, faults, or security events.

The community string is sent in plaintext in SNMPv1 and SNMPv2c, so it must be treated as a security credential; for production networks, SNMPv3 with encryption is preferred, but this command remains widely used for legacy or read-only monitoring. When you need to quickly enable SNMP for a monitoring tool, this is the go-to command. Alternatives include SNMPv3 configuration (which uses users and auth/priv passwords) or using an ACL to restrict SNMP access.

The command fits into the broader workflow of network monitoring: after basic IP connectivity and SNMP server reachability are confirmed, you configure the community string, optionally restrict it with an ACL, and then verify with `show snmp`. Important IOS behavior: the command takes effect immediately and is written to the running config; there is no buffered output. Privilege level 15 (enable) is required to configure it.

The community string is stored in plaintext in the configuration, so secure access to the device is essential. The command supports both read-only (ro) and read-write (rw) access; read-only is typical for monitoring, while read-write allows the NMS to change configurations (use with caution).

Syntax·Global Config

snmp-server community [string] [ro|rw]

When to Use This Command

Setting up a read-only community string for network monitoring tools like SolarWinds or PRTG to poll device statistics without making changes.
Configuring a read-write community string for a network management system that needs to modify device configurations or reset interfaces remotely.
Creating multiple community strings for different management stations with varying access levels for security segmentation.
Temporarily enabling a read-write community string during maintenance to allow automated scripts to push configuration changes.

Parameters

Parameter	Syntax	Required	Description
string	WORD (1-32 characters)	Required	The community string, which functions as a password. It can be any alphanumeric string up to 32 characters. Common mistakes include using weak strings like 'public' or 'private' in production, or including spaces (not allowed). For security, use a complex string similar to a strong password.
ro\|rw	ro \| rw	Required	Specifies the access level: 'ro' for read-only (allows GET and GETNEXT operations) or 'rw' for read-write (allows SET operations). Read-only is recommended for monitoring; read-write should be restricted with an ACL to prevent unauthorized changes.

Command Examples

Basic read-only community string

snmp-server community public ro

This command sets the SNMP community string to 'public' with read-only (ro) access. No output is generated upon successful configuration. Use 'show running-config | include snmp' to verify.

Read-write community string with ACL restriction

snmp-server community private rw 10

Sets community string 'private' with read-write (rw) access, restricted by access-list 10. The ACL must permit the NMS IP addresses. No output on success; verify with 'show snmp community'.

Understanding the Output

The command itself does not produce output. To verify SNMP community configuration, use 'show snmp community' or 'show running-config | include snmp-server community'. The 'show snmp community' output displays each community string, its access level (RO or RW), and any associated ACL.

For example: 'Community name: public, Access: read-only, ACL: none'. A good configuration shows the intended community strings with correct access. A bad configuration might show missing communities or incorrect ACLs.

Watch for unintended read-write communities that could pose a security risk.

Configuration Scenarios

Configure read-only SNMP community for network monitoring

A network administrator needs to monitor a Cisco router using a central NMS (e.g., SolarWinds). The NMS will poll interface statistics, CPU load, and uptime. Only read access is required.

Topology

NMS---192.168.1.0/24---(Gi0/1)R1(Gi0/0)---10.0.0.0/30---(Gi0/0)R2

Steps

1.Step 1: Enter global configuration mode: Router> enable, Router# configure terminal
2.Step 2: Configure the SNMP community string with read-only access: Router(config)# snmp-server community Mon1t0r ro
3.Step 3: (Optional) Restrict SNMP access to the NMS IP using an ACL: Router(config)# access-list 10 permit host 192.168.1.100, Router(config)# snmp-server community Mon1t0r ro 10
4.Step 4: Exit configuration mode and verify: Router(config)# end, Router# show snmp

Configuration

!
Router(config)# snmp-server community Mon1t0r ro
Router(config)# access-list 10 permit host 192.168.1.100
Router(config)# snmp-server community Mon1t0r ro 10
!

Verify: Use `show snmp` to verify the community string is configured. Look for 'Community string: Mon1t0r' in the output. Also use `show snmp community` to list all configured communities.

Watch out: If you forget to apply an ACL, any device with the community string can access SNMP. Always restrict access to trusted NMS IPs.

Configure read-write SNMP community for configuration management

A network engineer wants to allow a configuration management tool (e.g., Cisco Prime) to push configuration changes via SNMP SETs. This requires read-write access, but must be tightly controlled.

Topology

Prime Server---172.16.1.0/24---(Gi0/1)SW1(Gi0/0)---10.0.1.0/30---(Gi0/0)SW2

Steps

1.Step 1: Enter global configuration mode: Switch> enable, Switch# configure terminal
2.Step 2: Create an ACL to permit only the Prime server: Switch(config)# access-list 20 permit host 172.16.1.50
3.Step 3: Configure the SNMP community string with read-write access and apply the ACL: Switch(config)# snmp-server community C0nfigMgr rw 20
4.Step 4: Verify the configuration: Switch(config)# end, Switch# show snmp community

Configuration

!
Switch(config)# access-list 20 permit host 172.16.1.50
Switch(config)# snmp-server community C0nfigMgr rw 20
!

Verify: Use `show snmp community` to confirm the community string 'C0nfigMgr' is present with RW access and the ACL number 20. Also verify the ACL with `show access-list 20`.

Watch out: Read-write access is powerful; a misconfigured community string or ACL could allow unauthorized changes. Always use the strongest ACL possible and monitor SNMP SET operations.

Troubleshooting with This Command

When troubleshooting SNMP community string issues, the first step is to verify that the community string is configured correctly using `show snmp community`. Healthy output shows the community string, access level (RO or RW), and any associated ACL. If the output is empty or missing the expected community, the command was not applied or was overwritten.

A common problem is that the community string is present but the NMS cannot reach the device; check basic IP connectivity with `ping` from the NMS to the device. If reachable, verify that SNMP is not blocked by an ACL on the device or a firewall. Use `show snmp` to check SNMP statistics: look at 'SNMP packets input/output' and 'SNMP input/output errors'.

If input packets are zero, the NMS may be sending to the wrong community string or the device is not listening on UDP port 161. Use `show ip sockets` to confirm SNMP is listening. Another symptom is 'SNMP authentication failures' incrementing in `show snmp`; this indicates the NMS is sending an incorrect community string.

If using an ACL, verify with `show access-list <number>` that the NMS IP is permitted. For read-write issues, check that the community string has 'rw' and that the NMS is sending SNMP SET requests with the correct community. Correlate with debug commands: `debug snmp packet` is powerful but can overwhelm the console; use it briefly to see the community string being sent by the NMS.

Also check that SNMP version matches: the device defaults to SNMPv1/v2c; if the NMS uses SNMPv3, the community string is ignored. Finally, if the configuration seems correct but SNMP still fails, check if the device has an SNMP view or group that overrides community access. The command `snmp-server community` is straightforward, but misconfigurations often stem from ACL typos, community string mismatches, or IP reachability issues.

A systematic approach: verify community, verify ACL, verify connectivity, verify SNMP statistics, and then use debugs sparingly.

CCNA Exam Tips

CCNA exam may test that 'snmp-server community' is configured in global config mode, not interface mode.

Remember that 'ro' allows only SNMP GET operations, while 'rw' allows GET and SET operations.

The exam might ask about restricting SNMP access using an ACL: 'snmp-server community string rw <acl-number>'.

Be aware that the default community string 'public' with read-only access is often pre-configured and should be changed for security.

Common Mistakes

Using 'rw' when only monitoring is needed, exposing the device to unauthorized configuration changes.

Forgetting to apply an ACL to limit which management stations can use the community string, leading to security vulnerabilities.

Typing 'snmp-server community' in interface configuration mode instead of global configuration mode, resulting in an error.

snmp-server community [string] [ro|rw] vs snmp-server host [ip] [string]

Both commands involve community strings but serve distinct functions: one controls incoming SNMP access to the device, the other configures where outgoing SNMP notifications are sent. They are commonly confused because both require a community string and appear in the same global configuration context, yet they address different SNMP operations.

Aspect	snmp-server community [string] [ro\|rw]	snmp-server host [ip] [string]
Scope	Controls incoming SNMP requests (polls)	Controls outgoing SNMP notifications (traps/informs)
Authentication	Authenticates read-only or read-write access	Authenticates notifications sent to the specified host
Persistence	Stored in running-config, can be encrypted	Stored in running-config, community string may be displayed
Precedence	Applied to all incoming SNMP versions (v1/v2c)	Only affects traps/informs, not polls
Typical Use	Enable an NMS to read or write MIB objects	Send alerts to a management station

Use snmp-server community [string] [ro|rw] when you need to allow an SNMP manager to poll the device for monitoring or configuration data.

Use snmp-server host [ip] [string] when you need to direct SNMP traps or informs to a specific network management system.

Platform Notes

On IOS-XE (e.g., Catalyst 9000 switches), the `snmp-server community` command syntax is identical to classic IOS. However, IOS-XE may support additional parameters like `snmp-server community <string> view <view-name> ro/rw` to restrict MIB access. The output of `show snmp community` is similar but may include 'Group' information if SNMPv3 is also configured.

On NX-OS (e.g., Nexus switches), the equivalent command is `snmp-server community <string> group <group-name>` where the group defines access (ro/rw). For example: `snmp-server community MyString group network-operator` (read-only) or `snmp-server community MyString group network-admin` (read-write). NX-OS does not use the `ro` or `rw` keywords directly; instead, you must predefine SNMP groups with the desired access level.

On ASA firewalls, SNMP is configured via `snmp-server host` and `snmp-server community` commands, but the syntax differs: `snmp-server community <string>` is used, and access is controlled via `snmp-server host <ip> community <string>`. ASA also supports `snmp-server enable` to activate SNMP. On IOS-XR (e.g., ASR 9000), the command is `snmp-server community <string> [ro | rw] [ipv4 <acl>]` but note that IOS-XR uses a different configuration hierarchy (admin vs XR config mode).

In IOS 12.x, the command is the same as 15.x/16.x, but older versions may lack the ACL parameter. Always check the specific platform documentation for nuances.

Related Commands

access-list [1-99] permit|deny [source]

Creates a standard numbered access list (1-99) to permit or deny traffic based on source IP address, used to filter packets entering or leaving a router interface.

snmp-server host [ip] [string]

Configures the SNMP server to send SNMP notifications (traps or informs) to a specified host, using a community string for authentication.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions