System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

SNMPv3 access for lawful intercept

Updated: September 18, 2026

Want to summarize with AI?

Log in

Groups the procedures that disable SNMP-based lawful intercept, configure inband management-plane protection, and enable the LI SNMP server configuration.

Use this topic to understand the SNMPv3 procedures that support lawful intercept.

Disable SNMP-based lawful intercept

Lawful Intercept is enabled by default on the router after installing and activating the LI RPM package.

Before you begin

The lawful-intercept disable command is available only after the LI RPM package is installed and activated.

Procedure

Disable lawful intercept from global configuration mode.

Example:

Router# configure
Router(config)# lawful-intercept disable
Router(config)# commit

SNMP-based lawful intercept is disabled and all SNMP-based taps are dropped. Use the no form of the command to re-enable lawful intercept.

Configure inband management plane protection for LI

Configure the Management Plane Protection (MPP) feature for SNMP communication with the mediation device.

MPP is disabled by default. If MPP is not already configured for another protocol, configure it for SNMP communication with the mediation device. Configure an inband interface, such as a loopback interface, to allow SNMP commands to reach the router.

Procedure

  1. Configure inband SNMP access on loopback0 inband interface and commit the configuration.

    Example:

    Router# configure
Router(config)# control-plane
Router(config-ctrl)# management-plane
Router(config-mpp)# inband
Router(config-mpp-inband)# interface loopback0
Router(config-mpp-inband-Loopback0)# allow snmp
Router(config-mpp-inband-Loopback0)# commit

  2. Verify the inband SNMP configuration.

    Example:

    Router# show mgmt-plane inband interface loopback0
Management Plane Protection - inband interface
interface - Loopback0
snmp configured - All peers allowed

The inband management-plane configuration allows SNMP on loopback0. The verification output identifies the interface and confirms that SNMP is configured.

Enable the lawful intercept SNMP server configuration

Configure the SNMP engine, host, user, views, and group required for lawful intercept.

Before you begin

Perform this task even if you recently upgraded to Cisco IOS XR Software from Cisco IOS and had MPP configured for a protocol.

If you use a loopback interface for SNMP messages, include that interface in the inband management configuration.

Procedure

  1. Configure the local SNMP engine ID.

    Example:

    Router(config)# snmp-server engineID local 00:00:00:09:00:00:00:a1:61:6c:20:56

  2. Configure the SNMPv3 host.

    Example:

    Router(config)# snmp-server host 1.75.55.1 traps version 3 priv sample-user-name udp-port 4444

  3. Create the SNMPv3 user.

    Example:

    Router(config)# snmp-server user sample-user-name sample-li-group v3 auth md5 clear lab priv des56 clear lab

  4. Create the lawful intercept SNMP views.

    Example:

    Router(config)# snmp-server view sample-li-view ciscoTap2MIB included
Router(config)# snmp-server view sample-li-view ciscoIpTapMIB included
Router(config)# snmp-server view sample-li-view snmp included
Router(config)# snmp-server view sample-li-view ifMIB included
Router(config)# snmp-server view sample-li-view 1.3.6.1.6.3.1.1.4.1 included

  5. Configure the SNMPv3 group.

    Example:

    Router(config)# snmp-server group sample-li-group v3 auth read sample-li-view write sample-li-view notify sample-li-view
Router(config)# commit

The SNMP server is configured to support lawful intercept communication with the mediation device.