SystemCCNA 200-301

SNMPv3 Authentication Failure — Cannot Query OIDs

Presenting Symptom

SNMPv3 queries from the NMS to the router return 'No response' or 'Authentication failure' errors, and no OIDs can be retrieved.

Network Context

A small branch office with a Cisco ISR 4331 router running IOS XE 16.9. The router is configured with SNMPv3 for secure monitoring. The NMS (SolarWinds) is configured with the same SNMPv3 credentials. The problem occurs after a recent password change on the router's SNMPv3 user.

Diagnostic Steps

Verify SNMPv3 user configuration

show snmp user

User name: monitor
Engine ID: 800000090300001122334455
storage-type: nonvolatile
Active Access-list: none
Group name: readonly
Security Level: auth
Auth Protocol: SHA
Priv Protocol: AES128

Check that the user exists, has the correct security level (authPriv or authNoPriv), and that auth/priv protocols match the NMS. If the user is missing or has wrong parameters, this is the root cause.

Check SNMPv3 group and view configuration

show snmp group

Group name: readonly
Security Model: v3
Read view: v1default
Write view: <no writeview specified>
Notify view: <no notifyview specified>
Row status: active
Access-list: <no ACL>

Ensure the group has a read view (e.g., v1default or a custom view) that includes the OIDs being queried. If the read view is missing or restricted, queries will fail.

Test SNMPv3 authentication from the router itself

snmpget -v3 -l authPriv -u monitor -a SHA -A authpass -x AES -X privpass 192.168.1.1 1.3.6.1.2.1.1.1.0

SNMPv2-MIB::sysDescr.0 = STRING: Cisco IOS Software, ISR Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 16.9.4, RELEASE SOFTWARE (fc2)

If this command fails with 'Authentication failure' or 'No response', the credentials (auth/priv passwords) do not match between the router and the NMS. If it succeeds, the issue is likely on the NMS side.

Check SNMP debug output for authentication errors

debug snmp packet

SNMP: Packet received via UDP from 10.1.1.100 on GigabitEthernet0/0/0
SNMP: Packet version = 3
SNMP: Packet security model = USM
SNMP: usmProcessIncomingMsg: authentication failure for user monitor

The debug output confirms authentication failure. It indicates that the auth key (derived from the password) does not match. This points to a mismatch in the auth password or protocol.

Root Cause

The SNMPv3 user 'monitor' was configured with an auth password of 'AuthPass123', but the NMS was configured with 'AuthPass456'. The passwords must match exactly, including case sensitivity. Additionally, the auth protocol (SHA) must match on both sides.

Resolution

On the router, reconfigure the SNMPv3 user with the correct password that matches the NMS: ``` configure terminal snmp-server user monitor readonly v3 auth sha AuthPass456 priv aes 128 PrivPass789 end ``` This command sets the user 'monitor' in group 'readonly', with auth protocol SHA and password 'AuthPass456', and priv protocol AES 128 with password 'PrivPass789'. Ensure the NMS uses identical credentials.

Verification

Run the following commands to confirm: ``` show snmp user ``` Verify the user 'monitor' exists with the correct auth and priv protocols. ``` snmpget -v3 -l authPriv -u monitor -a SHA -A AuthPass456 -x AES -X PrivPass789 192.168.1.1 1.3.6.1.2.1.1.1.0 ``` Expected output: the sysDescr OID value, confirming successful authentication and query.

Prevention

1. Use a centralized credential management system to ensure SNMPv3 passwords are consistent across all devices and NMS. 2. Document SNMPv3 user configurations and include them in change management processes. 3. Regularly audit SNMPv3 configurations using scripts or network monitoring tools to detect mismatches.

CCNA Exam Relevance

On the CCNA 200-301 exam, SNMPv3 troubleshooting appears in multiple-choice and drag-and-drop questions. The exam tests understanding of SNMPv3 security models (noAuthNoPriv, authNoPriv, authPriv), the difference between auth and priv passwords, and the use of 'show snmp user' and 'show snmp group' commands. A key fact is that SNMPv3 uses USM (User-based Security Model) and requires matching credentials on both the agent and manager.

Exam Tips

Remember that SNMPv3 authentication failures are almost always due to mismatched passwords or protocols (MD5 vs SHA).

The 'show snmp user' command displays the security level (authNoPriv vs authPriv) and the auth/priv protocols — memorize this output.

In the exam, if a question shows 'snmp-server user' with only auth, the security level is authNoPriv; if both auth and priv are configured, it's authPriv.

Test Your CCNA Knowledge

Practice with scenario-based questions to prepare for the CCNA 200-301 exam.

Practice CCNA Questions