The security features provided in SNMPv3 are as follows:

• Message integrity—Ensures that a packet has not been tampered with during transit.

• Authentication—Determines that the message is from a valid source.

• Encryption—Scrambles the content of a packet to prevent it from being learned by an unauthorized source.

SNMPv3 is a security model in which an authentication strategy is set up for a user and the group in which the user resides. Security level is the permitted level of security within a security model. A combination of a security model and a security level determines which security mechanism is used when handling an SNMP packet.

The table below describes the combinations of SNMPv3 security models and levels.

SNMPv3 supports RFCs 1901 to 1908, 2104, 2206, 2213, 2214, and 2271 to 2275. For more information about SNMPv3, see RFC 2570, Introduction to Version 3 of the Internet-standard Network Management Framework (this document is not a standard).

Simple Network Management Protocol Version 3 (SNMPv3) provides different levels of security. If an authentication or an authorization request fails, a descriptive error message appears to indicate what went wrong. These error messages comply with RFC 3414, User-based Security Model (USM) for version 3 of the Simple Network Management Protocol (SNMPv3).

You can use the snmp-server usm cisco command to disable the descriptive messages, thus preventing malicious users from misusing the information shown in the error messages. The table below describes the Cisco-specific error messages shown when the snmp-server usm cisco command is used, and the table compares these messages with the corresponding RFC 3414-compliant error messages.

Note	If an SNMP user belonging to an SNMP group is not configured with the password or if the group security level is not the same as the user security level, the error shown is “AUTHORIZATION_ERROR”. The Cisco-specific error message for this scenario is “unknownUserName”.

To configure an SNMP server user, specify an SNMP group or a table that maps SNMP users to SNMP views. Then, specify the IP address or port number for the remote SNMP agent of the device where the user resides. Also, before you configure remote users for a particular agent, configure the SNMP engine ID by using the snmp-server engineID command for the remote agent. The SNMP engine ID of the remote agent is required to compute the authentication or privacy digests for the SNMP password. If the remote engine ID is not configured first, the configuration command will fail.

SNMP passwords are localized using the SNMP engine ID of the authoritative SNMP engine. For SNMP notifications such as inform requests, the authoritative SNMP agent is the remote agent. You must configure the SNMP engine ID of the remote agent in the SNMP database before you can send proxy requests or inform requests to it.

Note	The SNMP user cannot be removed if the engine ID is changed after configuring the SNMP user. To remove the user, you must first reconfigure all the SNMP configurations.

Note

Default values do not exist for authentication or privacy algorithms when you configure the SNMP commands. Also, no default passwords exist. The minimum length for a password is one character, although it is recommended to use at least eight characters for security. If you forget a password, you cannot recover it and must reconfigure the user. You can specify either a plain text password or a localized MD5 digest.

Perform this task to specify an SNMP server group name and to add a new user to an SNMP group.

1.    enable


2.    configure terminal


3.    snmp-server group [group-name {v1 | v2c | v3 [auth | noauth | priv]}] [read read-view] [write write-view] [notify notify-view] [access access-list]


4.    snmp-server engineID {local engine-id | remote ip-address [udp-port udp-port-number] [vrf vrf-name] engine-id-string}


5.    snmp-server user user-name group-name [remote ip-address [udp-port port]] {v1 | v2c | v3 [encrypted] [auth {md5 | sha} auth-password]} [access access-list]


6.    end

Device> enable

Device# configure terminal

Device(config)# snmp-server group group1 v3 auth access lmnop

Device(config)# snmp-server engineID remote 172.16.15.4 udp-port 120 1a2833c0129a

Device(config)# snmp-server user user1 group1 v3 auth md5 password123 

Device(config)# end

1.    enable


2.    show snmp group


3.    show snmp user [username]


4.    show snmp engineID

Device> enable

Device# show snmp group

groupname: V1                               security model:v1 
readview : v1default                        writeview: <no writeview specified> 
notifyview: <no notifyview specified>       
row status: active
groupname: ILMI                             security model:v1 
readview : *ilmi                            writeview: *ilmi                    
notifyview: <no notifyview specified>       
row status: active
groupname: ILMI                             security model:v2c 
readview : *ilmi                            writeview: *ilmi                    
notifyview: <no notifyview specified>       
row status: active
groupname: group1                           security model:v1 
readview : v1default                        writeview: <no writeview specified> 
notifyview: <no notifyview specified>       
row status: active

Device# show snmp user user1

User name: user1
Engine ID: 00000009020000000C025808
storage-type: nonvolatile active access-list: 10
Rowstatus: active
Authentication Protocol: MD5
Privacy protocol: DES
Group name: group1

Device# show snmp engineID

Local SNMP engineID: 1A2836C0129A
Remote Engine ID        IP-addr    Port
1A2833C0129A            remote     10.2.28.1 120