Previous versions of SNMP were configured using community strings and single-line commands in IOS.
SNMPv3 management is more like user/account management and the configuration does not appear in "show run" but is instead hidden in the private config. You access SNMPv3 configuration information via "show snmp x" commands.
SNMPv3 Communication.
There are three ways to configure SNMPv3 communication:
NoAuthNoPriv (called noauth in IOS) – username only authentication, packet sent cleartext.
AuthNoPriv (called auth in IOS) – HMAC authentication (SHA or MD5), packet sent cleartext.
AuthPriv (called priv in IOS) – HMAC authentication, encrypt entire packet.
SNMPv3 Groups.
Groups are configured as follows:
snmp-server group <groupname> v3 noauth|auth|priv [access X]
(access X is an ACL restricting hosts where accounts in the group can be accessed from).
SNMPv3 Users.
SNMP Users are configured as follows:
snmp-server user <user> <group> v3 auth <sha|md5> <pass> priv des <privpass> [access x]
Note: The password should be at least 8 letters long according to the RFC.
SNMPv3 Views.
These are used to control which MIBS the users can browse or which traps are allowed to be sent. There are three types:
Read views – Values you can look at by SNMP polling the device.
Write views – Values you can set via SNMP polling.
Notify views – Values that can be sent as SNMP traps.
I don't specifically use groups so the default settings are:
If you create a new group then it is given the read view "v1default".
If you create an SNMP trap configuration then the group associated with it has a notify view automatically generated by IOS. These views have names beginning with *tv.FFF
I've written a brief dit on getting older versions of CiscoWorks to support SNMPv3 here
Posts
