SNMPv3 Configuration on Cisco IOS and Junos: authPriv Setup

SNMPv1/v2c community strings cross the network in plaintext, which is why monitoring credentials on production gear should use SNMPv3 with authPriv - SHA authentication plus AES encryption. The catch is that SNMPv3's user/group/VACM model differs sharply between vendors: Cisco IOS collapses it into three global commands, while Junos splits users (USM) from access rights (VACM). This guide shows both, step by step, with the exact commands and an snmpwalk verification for each.

SNMPv3 Security Levels

• noAuthNoPriv - username only, no password, no encryption.
• authNoPriv - MD5/SHA authentication, no encryption.
• authPriv - SHA/MD5 authentication plus AES/DES payload encryption. Use this for production monitoring.

SNMPv3 on Cisco IOS / IOS-XE

Cisco's model: a group defines the security level and view, then a user is bound to the group with auth and privacy keys:

snmp-server view RESTRICTED iso included
snmp-server group ADMIN v3 priv read RESTRICTED
snmp-server user mon-user ADMIN v3 auth sha AuthPass123! priv aes 128 PrivPass123!

Breakdown: the group ADMIN uses SNMPv3 at priv level with read access to view RESTRICTED (the whole iso tree). The user mon-user authenticates with SHA and encrypts with AES-128. Verify with:

show snmp user
show snmp group

SNMPv3 on Juniper Junos

Junos separates the pieces explicitly: a view of OIDs, a USM user with auth/priv passwords, a security-to-group mapping, and VACM access entries granting the group read access to the view at a security level:

set snmp view TESTSNMP3VIEW oid .1 include
set snmp v3 usm local-engine user mon-user authentication-sha authentication-password AuthPass123!
set snmp v3 usm local-engine user mon-user privacy-aes128 privacy-password PrivPass123!
set snmp v3 vacm security-to-group security-model usm security-name mon-user group mon-grp
set snmp v3 vacm access group mon-grp default-context-prefix security-model any security-level authentication read-view TESTSNMP3VIEW
set snmp v3 vacm access group mon-grp default-context-prefix security-model any security-level privacy read-view TESTSNMP3VIEW

Two notes from real deployments: if the device uses a non-default routing-instance, duplicate the VACM access lines with that instance as the context-prefix (and add set snmp routing-instance-access). And after configuration, confirm with show snmp v3.

Verifying from the NMS Side

snmpwalk -v3 -u mon-user -l authPriv -a SHA -A 'AuthPass123!'          -x AES -X 'PrivPass123!' 192.0.2.10 SNMPv2-MIB::sysDescr

A successful walk returning sysDescr proves user, group, view, auth and privacy are all consistent. Common failures: password length/minimum-entropy policies (use 8+ character secrets), a view that excludes the OIDs the NMS polls, and forgetting that SNMPv3 user changes on Junos need a commit to take effect.

Hardening Notes

Restrict the NMS source addresses even with v3 (an ACL on the SNMP service), disable v1/v2c where possible, and keep SNMPv3 users separate from login accounts. For the wider AAA picture on Cisco gear see our RADIUS vs TACACS+ guide, and if the management platform still cannot poll, work through the step-by-step SNMP troubleshooting flow in our 华为 CE 交换机 SNMP 网管不通排查 article (the methodology applies to any vendor).

原文链接：https://icookservers.blog/2023/02/13/setting-up-snmpv3-on-cisco-ios-and-juniper-junos