WhiteTiger Blogs

Reluctant to deploy SNMPv3?

Often I hear organizations complain about SNMPv3 being too complex to deploy. A lot of TCP/IP protocols in networks today have some level of complexity, encryption, hashed passwords, double authentication, shared key, triple handshake mechanism, etc.
But yet SNMPv2 still has community strings sent in “clear text” over the network.

In a Cisco network, you can tighten SNMPv2 security by binding it to an ACL, but isn’t that just telling a potential hacker who the NMS systems are? I always say: Whoever owns the NMS server(s), owns the network.

Recently I have deployed SNMPv3 onto a Cisco Network and surprisingly to my delight, found that I needed only to spend two hours on research.
The following SNMPv3 configuration is for a Cisco IOS device and it turned out to be very useful, secure and versatile for various NMS systems to manage the network.

I think the core concept to understand about SNMPv3 is users, groups and views. Some of the online PDFs and bulletins I’ve come across so far, has this in common when it comes to creating a SNMP v3 configuration.
–
Conceptually, here are the steps, in this exact order.

1. Assign an Engine ID for the SNMP Entity (its optional, but a very good idea)
2. Define a view and select a MIB
3. Define a group and tie it to a “view”
4. Define a user, add it to a group and add a password.

Example:
1. server engineID local 111100000000000000000000
2.
a. snmp-server view NOCview mib-2 included
b. snmp-server view NOCview cisco included
c. snmp-server view NOCview v1default included

3. snmp-server group NOCengineers v3 auth write NOCview
4. snmp-server user NMSops NOCengineers v3 auth md5 passW0rd20systemX487

Of course, there are more options available with regards to security like adding the “priv” command to the group for instance. All it means is that data will be encrypted: des56 encryption is such an option.

Oh yes, when you display the configuration, you won’t see any users – they’re hidden. The only way you can “see” them is through the “show snmp users/groups” command. I truly hope my explanation was understandable and simple enough to tame the perception of SNMPv3.
All the best.

Cheers
Pierre

[wp_campaign_2]

(4 votes, average: 4.50 out of 5)
 Loading ...