In this blog post, we will explore the configuration of SNMPv3 on Cisco devices and how it can help you secure your SNMP communications.
What's new with SNMPv3?
SNMPv3 introduces three new elements that are SNMP View, SNMP Groups, and SNMP Users.
- SNMP View - SNMP View is a set of MIB (Management Information Base) objects that a particular SNMP user can access. It specifies which parts of the MIB tree are visible to a specific user or group. SNMP Views can be configured based on a particular portion of the MIB tree or specific objects within the MIB tree. For example, you can say that a particular SNMP agent can only access a device's Interface stats and nothing else. You can even go more granular by providing access to just specific interfaces.
- SNMP Groups - SNMP Groups are collections of SNMP users with the same SNMP View and access permissions. By assigning users to groups, you can simplify management and control access to specific portions of the MIB tree.
- SNMP Users - SNMP Users are individuals or entities that require access to the Network Device through SNMP.
SNMPv3, compared to SNMPv2c, also introduces several significant security improvements. These improvements include:
- Authentication - SNMPv3 includes support for message integrity and authentication through the use of MD5 or HMAC-SHA algorithms, which prevent unauthorized access to SNMP messages.
- Encryption - SNMPv3 provides confidentiality through the use of encryption algorithms such as DES/AES, which ensures that sensitive information is protected while being transmitted across the network.
Overall, SNMPv3 offers significant security enhancements over SNMPv2c, making it a more robust and secure protocol for managing network devices.
The table below describes the combinations of SNMPv3 security models and levels.
- noAuthNoPriv - Uses a username match for authentication with no encryption.
- authNoPriv - Uses MD5 or SHA Authentication but no encryption.
- authPriv - Uses MD5 or SHA Authentication and supports Encryption.
How to Configure SNMP Version 3
The configuration is very straightforward if you want to use the bare minimum, just configure a
group/user and off you go.
For this example, I'm going to go with
authpriv which provides a higher level of security. You can be up and running with just two lines of code as shown below.
snmp-server group TEST_GROUP v3 priv snmp-server user TEST_USER TEST_GROUP v3 auth sha cisco123 priv des cisco123
Navigate to your SNMP agent and add the device to it. For this example, I'm using LibreNMS.
You can use the following show commands to view the group/user stats.
switch-03#show snmp user User name: TEST_USER Engine ID: 800000090300500000090000 storage-type: nonvolatile active Authentication Protocol: SHA Privacy Protocol: DES Group-name: TEST_GROUP switch-03#show snmp group groupname: TEST_GROUP security model:v3 priv contextname: <no context specified> storage-type: nonvolatile readview : v1default writeview: <no writeview specified> notifyview: <no notifyview specified> row status: active
In conclusion, SNMPv3 should be used instead of SNMPv2c because it offers better security features such as authentication, encryption, and access control, which are crucial for protecting sensitive information and preventing unauthorized access to network devices.