Configuring and Verifying SNMP (v2c & v3)

1. SNMP Fundamentals: How Network Monitoring Works

Before we touch the command line, let's establish a solid theoretical foundation. SNMP operates on a simple but powerful manager-agent model.

• SNMP Manager: This is typically a server running Network Management Station (NMS) software (e.g., SolarWinds, PRTG, Cisco Prime). It's the central system that polls devices for information and receives alerts.
• SNMP Agent: This is software running on the managed devices (routers, switches, firewalls). It collects and stores information about the device and responds to requests from the SNMP Manager.
• Management Information Base (MIB): A hierarchical database within the agent that stores managed objects. Think of it as a highly organized library of all the things that can be monitored on a device.
• Object Identifier (OID): A unique address that points to a specific object within the MIB. For example, there are OIDs for interface status, CPU utilization, and device uptime.

To get a comprehensive overview of these components, the different versions of SNMP, and the types of messages they exchange, please watch the following video.

As you just learned, a key distinction is between Traps and Informs. Both are notifications sent from an agent to a manager, but a Trap is a "fire-and-forget" message sent via UDP. An Inform, on the other hand, requires an acknowledgment from the manager, adding a layer of reliability.

2. Configuring and Verifying SNMPv2c

SNMPv2c is still widely used due to its simplicity. Its security relies on a "community string," which acts as a plain-text password. Because this password is sent unencrypted, SNMPv2c is only suitable for trusted, internal networks where security is not a primary concern.

SNMPv2c Configuration Steps

Configuration is straightforward:

1. Define community strings: One for read-only (RO) access and, if needed, one for read-write (RW) access.
2. (Optional) Set device information: Define the device's location and a contact person.
3. Define the NMS host: Specify the IP address of the NMS that is allowed to poll this device.
4. Enable notifications (traps): Configure the device to send traps to the NMS for specific events.

Here is a sample configuration:

! Set optional device info
snmp-server location "Building A, IDF 2"
snmp-server contact "net-admin@example.com"

! 1. Define community strings
! RO string for general monitoring
snmp-server community CCNPRO ro
! RW string for configuration changes (use with caution)
snmp-server community CCNPRW rw

! 3. Define the NMS host and associate it with the RO community
snmp-server host 192.168.10.100 version 2c CCNPRO

! 4. Enable specific traps to be sent to the NMS
snmp-server enable traps snmp linkup linkdown
snmp-server enable traps config

The video from Jeremy's IT Lab that you watched earlier also includes a great demonstration of this process and, importantly, shows a packet capture that reveals the community string in plain text, highlighting the security risk.

SNMPv2c Verification

To verify your configuration, you can use these commands:

• show run | include snmp: Displays all SNMP-related commands in your running configuration.
• show snmp community: Shows the configured community strings, their access level (RO/RW), and any associated access lists.

3. Configuring and Verifying SNMPv3

SNMPv3 is the industry standard for secure network monitoring. It replaces the simple community string with a robust User-based Security Model (USM) that provides:

• Authentication: Verifies that the message is from a valid source (using MD5 or SHA).
• Encryption (Privacy): Encrypts the packet payload to prevent eavesdropping (using DES, 3DES, or AES).

SNMPv3 Security Model and Levels

SNMPv3 introduces three key components for configuration: View, Group, and User.

1. View: Defines what a user can see (which OID trees are accessible).
2. Group: Defines how a user can access it. It maps users to views and specifies the security level required.
3. User: Defines who can access the device, including their authentication and privacy credentials.

These components are used to enforce one of three security levels:

• noAuthNoPriv: No authentication, no privacy. (Essentially SNMPv1 behavior).
• authNoPriv: Authentication but no privacy.
• authPriv: Both authentication and privacy. This is the recommended best practice.

This next video is an excellent, focused guide to configuring SNMPv3 from the ground up, explaining each component as it's configured.

SNMPv3 Configuration Steps (authPriv)

Let's consolidate what you've just seen into a best-practice configuration template. For a detailed text-based walkthrough with additional tips, the article "Cisco Switch / Router SNMPv3 Configuration" is an excellent companion resource.

Here is a configuration example for read-only access using the authPriv security level:

! Create an access-list to permit only your NMS server(s)
ip access-list standard NMS_ACL
 permit 192.168.10.100
 deny   any

! 1. Create a view giving access to the entire MIB tree
snmp-server view ALL_VIEW iso included

! 2. Create a group, map it to the view, specify the 'priv' security level, and apply the ACL
snmp-server group MONITOR_GROUP v3 priv read ALL_VIEW access NMS_ACL

! 3. Create a user, assign to the group, and set auth/priv passwords
! Format: snmp-server user <user> <group> v3 auth <sha|md5> <auth_pass> priv <aes|des|3des> [128|192|256] <priv_pass>
snmp-server user snmp-ro-user MONITOR_GROUP v3 auth sha StrongAuthP@ss! priv aes 128 StrongPrivP@ss!

! 4. Configure the host to send traps/informs to, using the created user's credentials
snmp-server host 192.168.10.100 version 3 priv snmp-ro-user
snmp-server enable traps

SNMPv3 Verification

Verification is critical for SNMPv3. Use these commands to check each component of your configuration:

• show snmp view: Verifies the configured views.
• show snmp group: Shows the group name, security model, access levels, and associated view.
• show snmp user: The most important command. It displays configured users, the group they belong to, and their authentication/encryption settings.
• show snmp host: Shows which NMS hosts are configured to receive notifications.

Conclusion

Congratulations! You have now covered the essentials of configuring and verifying both SNMPv2c and SNMPv3, a critical skill for network monitoring and management.

Key Takeaways:

• SNMP provides network visibility through a Manager/Agent model, using MIBs and OIDs to access data.
• SNMPv2c is simple to configure using plain-text community strings but is inherently insecure.
• SNMPv3 is the secure standard, providing authentication and encryption through a User-Group-View model.
• The authPriv security level is the recommended best practice for SNMPv3.
• Verification commands like show snmp user and show snmp group are essential for troubleshooting SNMPv3, as user details are not in the running configuration.

Preview of the Next Lesson:

So far in this course, our focus has been primarily on unicast traffic—communication from one point to another. In our next lesson, "Analyze multicast fundamentals including IGMP operation and multicast addressing," we will explore a different communication model. You'll learn how networks efficiently deliver traffic from one source to many destinations simultaneously, a process that is fundamental to services like IPTV and enterprise video streaming.