System Management Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

PDF

System Management Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

Configure SNMP secure-v3

Updated: September 11, 2026

Want to summarize with AI?

Describes how SNMP secure-v3 CLI features enforce the secure network management by restricting configuration to strong authentication and encryption algorithms.

A SNMP secure-v3 feature is a network management configuration option that

enables the secure-v3 keyword for SNMP CLI commands to require only SHA-2 authentication algorithms and AES-based privacy encryption,
removes support for legacy SNMP versions (v1, v2c) and insecure cryptographic options such as MD5, SHA-1, DES, and 3DES, and
requires explicit authentication and privacy settings for all SNMP users, with all passwords entered using clear or encrypted options and stored using AES encryption.

Table 1. Feature History Table
Feature Name	Release Information	Feature Description
Configure SNMP secure-v3	Release 26.3.1	Introduced in this release on: Fixed Systems-Cisco 8010 Series Routers (ASIC: A100), Cisco 8200 Series Routers (ASICs: Q100, Q200, and P100), and Cisco 8700 Series Routers (ASICs: P100 and K100). This feature enhances the SNMP security by configuring only SNMPv3 with SHA-2 authentication and AES-based privacy using the secure-v3 CLI. The router continues to support SNMPv1, SNMPv2c, and legacy SNMPv3 configurations, but these configurations are deprecated. If a legacy SNMP configuration remains active, the router logs a deprecation warning every 30 days. The router rejects the commit if the same group, user, or notification host user is configured through both legacy SNMP and SNMP secure-v3.

Restrictions for SNMP secure-v3

A SNMP secure-v3 requires authentication and privacy and supports only approved authentication and encryption algorithms.

The same group or user cannot use both legacy and secure configuration.
SNMP secure-v3 always uses the authPriv security level. The vsecure-v3 group, host, and VRF-specific host commands do not require a separate security-level keyword. The secure-v3 user command requires the auth and priv keywords to configure the authentication and privacy algorithms and passwords.
Only SHA-2 variants (such as SHA-224, SHA-256, SHA-384, and SHA-512) are supported for authentication. The MD5 and SHA-1 are not supported.
SNMP secure-v3 supports AES-128, AES-192 and AES-256. DES and 3DES are not supported.
A notification host-user can be associated with only one SNMP version.
Legacy SNMP user and notification host configurations support type 6 or type 7 encryption. SNMP secure-v3 supports only type 6 encryption for these configurations.

Configure SNMP secure-v3

Create a secure SNMPv3 group and user. You can also configure trap or inform recipients in the default VRF or a specific VRF.

Secure SNMPv3 requires the authPriv security level. It supports SHA-224, SHA-256, SHA-384, or SHA-512 authentication and AES-128, AES-192 and AES-256 privacy.

Before you begin

Remove all legacy SNMP v1, v2c, and v3 user, group, and host configuration from the device.
Access privileged EXEC mode and global configuration mode.

Enable AES password encryption before configuring the primary encryption key.

Router# configure
Router(config)# password6 encryption aes
Router(config)# commit
Router(config)# end
Router# key config-key password-encryption
Router# show type6 server

Follow these steps to configure SNMP secure-v3 CLI for user, group, and host setup.

Procedure

Enter global configuration mode.
Example:
```
Router# configure
```

Create the SNMP secure-v3 group.

Example:

Router(config)# snmp-server group <group-name> secure-v3

Create the SNMP secure-v3 user.

Example:

Router(config)# snmp-server user <user-name> <group-name> secure-v3 auth {sha-224 | sha-256 | sha-384 | sha-512} {clear | encrypted} encryption-aes <authentication-password> priv aes {128 | 192 | 256} {clear | encrypted} encryption-aes <privacy-password>

If a supplied password is already encrypted, replace the corresponding clear keyword with encrypted.

The authentication-password and privacy-password choices are independent.

Configure a destination SNMP host for traps or informs using the secure-v3 version and user.

Example:

Router(config)# snmp-server host <host-ip-address> version secure-v3 {<user-name> | clear encryption-aes <user-name> | encrypted encryption-aes <encrypted-user-name>} [udp-port <port-number>]
Router(config)# snmp-server host <host-ip-address> informs version secure-v3 {<user-name> | clear encryption-aes <user-name> | encrypted encryption-aes <encrypted-user-name>} [udp-port <port-number>]
Router(config)# snmp-server vrf <vrf-name> host <host-ip-address> version secure-v3 {<user-name> | clear encryption-aes <user-name> | encrypted encryption-aes <encrypted-user-name>} [udp-port <port-number>]
Router(config)# snmp-server vrf <vrf-name> host <host-ip-address> informs version secure-v3 {<user-name> | clear encryption-aes <user-name> | encrypted encryption-aes <encrypted-user-name>} [udp-port <port-number>]

Use <user-name> to enter the username directly as a WORD value. Do not enter the encryption-aes keyword with this form.
Use clear encryption-aes <user-name> to enter an unencrypted username and store it using AES encryption.
Use encrypted encryption-aes <encrypted-user-name> when the supplied username is already encrypted.
To specify a UDP port, include udp-port <port-number>.
Enter only the command corresponding to the required trap or inform recipient and VRF.

Commit the configuration.
Example:
```
Router(config)# commit
```

Verify the SNMP secure-v3.

Example:

Router# show running-config snmp-server
Router# show snmp group
Router# show snmp user
Router# show snmp host
Router# show snmp trace configuration

The secure SNMPv3 group and user are created after the configuration is committed. If notification recipients are configured, the router sends secure SNMPv3 traps or informs to the specified destinations.

What to do next

Confirm that the SNMP manager can authenticate the user and decrypt SNMP messages.
To delete the configuration, see Remove SNMP secure-v3 configuration.

Remove SNMP secure-v3 configuration

Remove SNMP secure-v3 notification recipients, users, and groups from the router.

Procedure

Remove a trap and inform recipients from the default VRF.

Example:

Router# configure
Router(config)# no snmp-server host <host-ip-address> traps version secure-v3 <user-name>
Router(config)# no snmp-server host <host-ip-address> informs version secure-v3 <user-name>

Remove a trap and inform recipients from a specific VRF.

Example:

Router(config)# no snmp-server vrf <vrf-name> host <host-ip-address> traps version secure-v3 <user-name>
Router(config)# no snmp-server vrf <vrf-name> host <host-ip-address> informs version secure-v3 <user-name>

Remove a secure-v3 SNMP user and group if no longer is needed.

Example:

Router(config)# no snmp-server user <user-name>
Router(config)# no snmp-server group <group-name>

Commit the changes.
Example:
```
Router(config)# commit
```

After the commit, the specified SNMP secure-v3 group, user, and notification recipients are removed.

What to do next

Use the following commands to confirm the removal:

Router# show running-config snmp-server
Router# show snmp group
Router# show snmp user
Router# show snmp host

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.