Lab: Configure SNMPv3

Simple Network Management Protocol (SNMP) is used to monitor and manage network devices. SNMPv1 and SNMPv2c use community strings (plaintext passwords) for authentication, which are sent in clear text and easily intercepted. SNMPv3 addresses these security flaws by adding three security features: authentication (verifying the source), privacy (encryption of payload), and integrity (ensuring data is not modified in transit). The CCNA 200-301 exam tests your ability to configure SNMPv3 on Cisco IOS devices, including creating users, setting security levels, and verifying the configuration.

SNMPv3 defines three security models: noAuthNoPriv, authNoPriv, and authPriv. The security level determines what protections are applied:

The exam expects you to know these three levels and when to use each. For production, authPriv is recommended.

Configuring SNMPv3 involves several steps: enabling SNMP, creating an SNMP group (which defines the security model and access rights), and creating an SNMP user (which assigns authentication and privacy keys). Here is a typical configuration sequence:

! Step 1: Enable SNMP server (if not already enabled)
Router(config)# snmp-server enable traps
Router(config)# snmp-server host 192.168.1.100 version 3 auth priv SNMP_USER

! Step 2: Create an SNMP group with security model and access
Router(config)# snmp-server group ADMIN v3 priv read WRITE access 10

! Step 3: Create an SNMP user with authentication and privacy keys
Router(config)# snmp-server user SNMP_USER ADMIN v3 auth sha myAuthKey priv aes 128 myPrivKey

! Step 4: (Optional) Restrict SNMP access using an ACL
Router(config)# access-list 10 permit 192.168.1.100
Router(config)# access-list 10 deny any

In this example:

When an NMS sends an SNMPv3 Get-Request to the router:

Use the following show commands to verify SNMPv3 configuration:

Router# show snmp user
User name: SNMP_USER
Engine ID: 80000009030000E0F7B2A301
storage-type: nonvolatile   active
Authentication Protocol: SHA
Privacy Protocol: AES128
Group-name: ADMIN

Router# show snmp group
groupname: ADMIN                             security model: v3 priv
contextname: <nil>                           storage-type: nonvolatile
readview: WRITE                              writeview: <no writeview specified>
notifyview: <no notifyview specified>        
row status: active

Router# show snmp engineID
Local SNMP engineID: 80000009030000E0F7B2A301
Remote SNMP engineID: (none)

SNMPv3 can also be used for traps and informs. When configuring trap destinations, you must specify the security level and username that the router will use to send traps. For example:

Router(config)# snmp-server host 192.168.1.100 version 3 auth priv SNMP_USER traps

This ensures that traps sent to the NMS are authenticated and encrypted. The NMS must have the same user credentials configured to decode the traps.

Router(config)# snmp-server host 192.168.1.100 informs version 3 auth priv SNMP_USER

SNMPv3 provides secure network management by adding authentication, encryption, and integrity. On the CCNA exam, you must be able to configure users and groups, understand the three security levels, and verify the configuration with show commands. Remember that SNMPv3 is a significant improvement over v2c, and Cisco expects you to know how to deploy it in a secure enterprise environment.

In enterprise networks, SNMPv3 is used to secure management traffic, especially when devices are managed over untrusted networks (e.g., WAN links or cloud-managed branches). For example, a large bank with hundreds of routers and switches uses SNMPv3 to collect interface utilization and CPU stats. The NMS (like SolarWinds or PRTG) is configured with SNMPv3 users for each device. The network team creates a standard SNMPv3 user on all devices with the same credentials for simplicity, but uses different keys per device for better security. ACLs restrict SNMP access to only the NMS IPs. This prevents attackers from sniffing SNMP traffic and learning network topology.

Another scenario: A service provider uses SNMPv3 to monitor customer edge routers. Each customer has a unique SNMPv3 user with its own authentication and privacy keys. The provider configures the NMS to poll each router using the appropriate credentials. This ensures that one customer cannot query another customer's device. If a misconfiguration occurs (e.g., wrong privacy protocol), the NMS will fail to poll, and the monitoring system alerts the NOC.

Performance considerations: SNMPv3 with authPriv adds CPU overhead due to encryption and HMAC computation. For devices with limited CPU (e.g., older routers), using authNoPriv may be a compromise. However, modern devices handle it easily. Polling intervals should be set appropriately (e.g., every 5 minutes) to avoid overwhelming the device. Traps should be rate-limited to prevent storms.

Misconfigurations: A common mistake is forgetting to apply an ACL, leaving SNMP open to the world. Another is using the same password for authentication and privacy, which reduces security. Also, if the NMS and agent have different engine IDs (e.g., after a device replacement), the keys must be reconfigured because keys are derived from the engine ID.