Request - SNMPv3

[aguante_boca]

Dear Fellows,

I have been reading about SNMPv3 and its features for security.

Could you please confirm me if the next steps are correct?

1) Defining a view:
router(config)#snmp-server view readview internet included

2) Creating a group:

router(config)#snmp-server group readonly v3 auth read readview

3) Creating a user:

router(config)#snmp-server user user1 readonly v3 auth md5 password1
4) Createing the user at the SNMP Manager.

Is correct what is written above ?

Moreover,  I would like to know if there is any chance to obtain the username and  password of the point 3) from a TACACS server or RADIUS server?. The  idea is that there is no need to create a new user locally. So that, the  users and passwords could be obtained from a TACACS or RADIUS?

Thanks you in advanced!.

[aguante_boca]

Dear Fellows,

Could you please help me with any response about this issue?.

Thanks in advanced.

[Tarik Admani · Accepted solution]

Hi,

You may want to post this question in the Network Management section, but I am pretty sure that this username is for authenticating snmp communication which is separate from AAA. The snmp user account for is locally significant and I am pretty sure that this account can not be centralized. Please run this by the forum for a more concrete answer.

Thanks,

Sent from Cisco Technical Support iPad App

[aguante_boca]

Dear Tarik,

Firstly I posted this question at Network Management. However, from

supportforums-info@cisco.com I was informed that this request should be posted at this path Cisco Support Community -> NetPro -> Security -> AAA, Identity and NAC ->Discussions.

Finally, Thank you very much for your response.

BR,

Onno Olivier

[aguante_boca]

Dear Tarik,

Moreover, Is there any chance to coexist SNMPv2 and SNMPv3 on the same equipment ?.

Thanks for your help!

[Tarik Admani · Accepted solution]

The SNMP version is determined by the entry of the snmp host. If you set the host version to version 2 or version 3, then the host will need to know either the snmpv2 community string for read and write, or the snmp user name, hashing algorithm and/or encryption mechanism.

In the end that is entirely up to you on how you deploy it, you can try creating two separate entries for the same host using both version 2 and 3 (I have never tested that but I wouldnt know why it wouldnt work).

Keep in mind that when it comes to snmpv3 that snmpv2 is used for read requests, while v3 is used for write. You can verify this with a packet capture.

Thanks,

Sent from Cisco Technical Support iPad App

[aguante_boca]

Thank you very much for your help!

[valentinrosic]

hello,

has anyone successfully configured snmpv3 authentication via radius or tacacs?

kind regards