SNMPV3 Configuration on cisco routers and switches

[alkabeer80]

Hi, i want to configure snmp v3 on my cisco routers and switches,

i used the below commands pointing to snmp server, but it wont work, i tried to do snmpwalk from the server it shows

security level is not supported by SNMP agent and on other devices ti shows verfiy credentials

snmp-server group mygroup v3 auth read root

snmp-server user netadmin mygroup v3 auth sha root

snmp-server host 10.1.1.1 version 3 auth netadmin

what else i need to do to let it work ?????

thankssssssssss

[alkabeer80]

any help ???

[Vinod Arya · Accepted solution]

You seems to be missing a SNMP v3 View. For security it is important to have view configured to control the access level by users and groups. You seems to have associated your group mygroup to a read only view root which is not configured.

You can configured following to make this work :

snmp-server view root iso included

-Thanks

Vinod

[thushar362]

Hi Vinod,

               Can't we use the command "snmp-server community community-string rw " for configuring SNMP v3 ? Along with that can we use "snmp-server user username groupname v3 auth md5 auth-password [priv des56 {clear | encrypted} priv-password]]} ". Is there any relation between  "community-string"  and "auth-password" ???. Please provide the answer as soon as possible.

[Marvin Rhoads]

The community-string is used by SNMPv1 and SNMPv2C for unencrypted authentication.

Leaving those in place while also setting up SNMPv3 support sort of defeats one of the big the advantages of SNMPv3, specifically the ability to encrypt the authentication mechanism.