Infrastructure Services · Topic 2 of 6
Troubleshooting SNMP v2c and v3
Troubleshoot SNMP on IOS XE: v2c community strings against v3 users, groups and security levels, plus traps, informs, ACLs and verification commands.
- 4 min
- SNMP uses UDP 161 for requests and UDP 162 for traps and informs.
- v2c uses community strings in clear text.
- v3 adds users, authentication and encryption.
What it is
SNMP lets a management station read data from a device, change settings, and receive alerts when something happens.
The device runs an agent, and the management station is the NMS. Data is organised in a MIB, where each item has an object identifier (OID).
SNMP version 2c secures access with a community string. Version 3 adds users, authentication and encryption.
How it works
The agent answers requests on UDP port 161, and sends alerts to the NMS on UDP port 162.
Message types
| Message | Direction | Purpose |
|---|---|---|
| Get and GetNext | NMS to agent | Read one or more objects |
| GetBulk | NMS to agent | Read many objects in one request, in v2c and v3 |
| Set | NMS to agent | Change a value |
| Trap | Agent to NMS | Alert with no acknowledgement |
| Inform | Agent to NMS | Alert that the NMS must acknowledge |
An inform is retransmitted if no acknowledgement arrives. A trap is sent once.
SNMPv2c
Version 2c uses a community string as a shared password. The string is sent in clear text. A read only community allows reads, and a read write community allows changes.
R1(config)# snmp-server community READONLY1 RO 10
R1(config)# snmp-server community READWRITE1 RW 10
R1(config)# access-list 10 permit 10.1.1.50
R1(config)# snmp-server host 10.1.1.50 version 2c READONLY1
R1(config)# snmp-server enable traps
R1(config)# snmp-server source-interface traps Loopback0The number 10 ties the community to an ACL, so only that station may use it. The snmp-server host line sends traps to the NMS, and snmp-server enable traps selects which events send them.
SNMPv3
Version 3 has three parts.
- A view limits which parts of the MIB are visible.
- A group sets the security level and the views.
- A user belongs to a group and has its own keys.
There are three security levels.
| Level | Authentication | Encryption |
|---|---|---|
| noAuthNoPriv | Username only | No |
| authNoPriv | Yes | No |
| authPriv | Yes | Yes |
R1(config)# snmp-server group ADMINS v3 priv access 10
R1(config)# snmp-server user SNMPUSER ADMINS v3 auth sha AuthPass123 priv aes 128 PrivPass123
R1(config)# snmp-server host 10.1.1.50 version 3 priv SNMPUSERThe group is set to priv, which means authentication and encryption. The user must have both an auth and a priv key to match.
The NMS must use the same user name, level and keys. A mismatch of any one of them makes requests fail.
Troubleshooting
The first question is whether the request reaches the agent, and the second is whether the credentials match.
- Is UDP 161 reachable, and is no ACL or firewall in the way?
- Does the community or user match exactly, including case?
- Does the ACL on the community include the NMS address?
- For v3, do the security level, auth protocol and keys all match?
- For traps, is
snmp-server hostset and are the traps enabled? - Does the source address match what the NMS expects?
R1# show snmp
R1# show snmp community
R1# show snmp user
R1# show snmp group
R1# show snmp host
R1# debug snmp packetsshow snmp shows packet counters, including counters for rejected requests. show snmp user lists the v3 users. A v3 user is not shown in the running configuration, so use this command instead.
Traps do not arrive for several reasons. The host might be wrong, the event may not be enabled, or the router source address is not trusted by the NMS. An inform helps because the router knows when the NMS did not acknowledge.
The NMS and the agent must agree on the version first. A v2c request to a v3 only user will fail, whatever the credentials.
What to remember for the exam
Seven facts cover most questions on this topic.
- SNMP uses UDP 161 for requests and UDP 162 for traps and informs.
- v2c uses community strings in clear text.
- v3 adds users, authentication and encryption.
- v3 levels are noAuthNoPriv, authNoPriv and authPriv.
- An inform is acknowledged, and a trap is not.
- An ACL on a community limits which stations may use it.
show snmp usershows v3 users, which are not in the running configuration.
A read write community with a guessable name lets an attacker change the device. Use an ACL and prefer v3.
Common mistakes
These five mistakes appear often.
Wrong community or case. Community strings are case sensitive.
ACL without the NMS. The agent silently ignores the request.
Security level mismatch. A user configured for authPriv fails if the NMS asks for authNoPriv.
Traps not enabled. snmp-server host alone does not choose which events are sent.
Different keys. Auth or privacy keys that differ from the NMS cause authentication errors.
Check yourself
Work through these three questions.
Which ports does SNMP use?
UDP 161 for requests to the agent and UDP 162 for traps and informs to the manager.
What is the difference between a trap and an inform?
An inform must be acknowledged by the NMS and is resent if it is not, while a trap is sent once with no acknowledgement.
Which security level gives both authentication and encryption?
authPriv.
Topic 2 of 6 in Infrastructure Services
Test yourself on Infrastructure Services
The full Cisco CCNP 300-410 ENARSI question bank has 857 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.