Collections
Deploying a Cisco Switch
SNMPv3 Configuration (Opt.)

SNMPv3 Configuration (Opt.)

SNMP (Simple Network Management Protocol) is a common protocol used in monitoring networking equipment. This article will walk through configure SNMP Version 3, the latest and most secure version of SNMP.

Restrict Access

Create an IP access-list of all the services which will be allowed to query the SNMP service.

Switch (config)# ip access-list standard snmp-service
Switch (config-std-nacl)# permit 10.0.0.16  
Switch (config-std-nacl)# permit 10.0.0.17

Configure Views

Create two new views, one which will have read-only privileges (called “SNMP-v3-RO-View “) and another with read-write privileges (called “SNMP-v3-RW-View”). Both views will be able to walk through the ‘ISO’ OIDs (aka. the OIDs containing SNMP information).

ℹ️
For more information on SNMP works, please see this great article. 
Switch (config)# snmp-server view SNMP-v3-RO-View iso included 
Switch (config)# snmp-server view SNMP-v3-RW-View iso included

Configure Groups

Create a group for each view outlining that group’s privilege level (read/write). In this example, the SNMP-v3-RO group, which has been assigned the SNMP-v3-RO-View view, can only read the SNMP information(priv read), never write.

Switch (config)# snmp-server group SNMP-v3-RO v3 priv read SNMP-v3-RO-View access snmp-service
Switch (config)# snmp-server group SNMP-v3-RW v3 priv write SNMP-v3-RW-View access snmp-service

Configure & Assign Users

Create a new user for each group that will allow querying of the SNMP service from external tools. For this example, the user SNMP-v3-RO-User will be created and added to the SNMP-v3-RO group. Being a member of this group in turn grants the account access to the SNMP-v3-RO-View view. Two passwords are required when running this command:

  1. Auth - Password to authenticate the user.
  2. Priv - Secret used to enable encryption of the SNMP messages.
Switch (config)# snmp-server user SNMP-v3-RO-User SNMP-v3-RO v3 auth sha [password] priv aes 128 [password] access snmp-service
Switch (config)# snmp-server user SNMP-v3-RW-User SNMP-v3-RW v3 auth sha [password] priv aes 128 [password] access snmp-service

The account can now be used to monitor your switch via SNMP.

Configuration Backup (Opt.)