SNMP Community String Encryption

[avilt]

I need to encrypt the SNMP community string on Cisco IOS switches and ASA firewalls? What is the command to enable the encryption?

[Marvin Rhoads · Accepted solution]

The community string in SNMPv1 and v2 itself is not encrypted (or able to be configured to be encrypted).

If you setup your devices to use only SNMPv3, you can set both privacy (PRIV) and authentication (AUTH) strings. Those are stored as MD5- or SHA-hashed values on the device. Using a privacy string means the communications between the device and the SNMPv3 user will be encrypted using DES, 3DES or AES (-128, -192 or -256 according to your configuration).

[avilt]

In the following command, is it possible to encrypt the priv password? From the running config, I would like to hide or encrypt this string.

snmp-server host 10.0.10.61 version 3 priv mypassword

[Rob Ingram]

Hi, An snmpv3 user configuration/password is not viewable in the running configuration, they are stored in the private-config. You would have to run "show snmp user" to view the attributes of a configured snmp v3 user, which does not display the password either. So you should be fine.

[avilt]

The following command is used to authenticate and receive the snmp traps. How do I encrypt the password in running config in the following command. I have already enabled service password-encryption

snmp-server host 10.0.10.61 version 3 priv mypassword

[Rob Ingram]

It's not a password being specified using that command (see below), it's requiring a v3 username, which as mentioned previously is not displayed in the running-config.

LAB-RTR(config)# snmp-server host  192.168.10.100 version 3 priv ?
  WORD  SNMPv1/v2c community string or SNMPv3 user name

HTH