- [Instructor] We've already taken a look at configuring
SNMP version two so we want to now look
at how we can do the same for SNMP version three.
Now, this is a bit more involved
just because of all the added security features
found within this most recent version.
If we run the command, show IP access-lists,
we can see the standard access list
that we already have in place.
This is one that was configured
in our previous SNMP version two video.
This access control list will allow traffic
only from our two approved SNMP agent devices
which you can see in our topology, 10.1.1.5
and 20.1.1.5, so that's great, we are to have that in place.
The first thing we want to do after this is to define
an snmp-server group.
This is going to create some security policies
that we can have applied to specific users.
Any user that we assign to this particular server group,
they would have the attached security policy.
So first thing, let's run a Show-Command.
So we'll say, show snmp mib.
And you can see this is going to give a very long list
of those MIBs, the management information bases.
We discussed these in our SNMP theory video
and we talked about how the MIB is a hierarchical structure
that forms a tree and then it contains object
identifiers or OIDs.
Each OID represents a variable that can be read
or set through SNMP.
And so this output is an example of those OIDs.
So we can see several of those on here.
If we want to point one out specifically,
we can see ifInErrors,
so if we have interface input errors,
the name of that is ifInErrors.
We can see the exact name of that.
So let's keep that specific name in mind just for a bit.
As we start looking at our SNMP
version three configurations.
Now, one of the first things
that we might want to do is to set
up a specific view for users.
So this going to allow us to see only certain things.
This going to allow certain things to be collected
through an SNMP view.
If we go under global configuration mode
and let's say, snmp-server view.
And then let's take a look at our contextual help,
you'll see that the first thing
we need to do is give this particular view a name.
So I'll just make that help desk in all lowercase.
So if we look at help again,
now, it indicates that we need to define a particular MIB.
That name as you can see here on the screen
that we pointed out earlier is ifInErrors.
So we do want to use one of these specific MIBS
that are found on this router, and that is case-sensitive
so I'll say ifInErrors.
If we do put in an invalid name
it's going to tell us that it's an invalid MIB.
So we want to be sure that we get that exactly right.
And contextual help again, after this is going to indicate
that we can use either the included or excluded keyword.
So what we're doing is we're saying either only entries
related to interface errors under this MIB family
will be readable in this view
or that everything except this MIB family
will be readable for this user group.
So we can do either one of those here.
In my case, in this example, I'll say include
so this will only present this single MIB family
of OIDs under this SNMP view.
We can run that command, by the way,
we can run that again and again and add multiple items
to be included or excluded.
By default, if we don't set up a view,
all of the MIB variables are going to be visible to the users.
So I'll go ahead and hit Enter on that.
We can get start the configuration by saying,
snmp-server group and from contextual help
you'll see that we need to give that a name.
I'll make that name just something very simple,
I'll call it admin.
And now, we need to choose a particular security model,
in other words, which version of SNMP
is this group going to be using?
I'll choose version three here,
so I'll say, v3 as the keyword.
And now, we can see that different security
levels are available to us.
Remember, we looked at these in the SNMP theory video.
SNMP version three has three security levels
and those are represented here with the keywords
auth, noAuth, and priv.
Auth is going to provide packet authentication
but no encryption.
NoAuth is going to be the most basic equivalent to SNMP
version one so that uses no authentication
and no encryption.
And priv is the most secure option
because it's going to provide both
authentication and encryption.
So of course, we want to use that most robust option
so I'll enter the priv keyword here.
Contextual help again, tells us that we can use read,
write, and notify keywords.
Now, these are only valid if we've configured a view.
So if you're using a default view this will not work.
But with a view set up, you can limit users
access to read, write, or notification operations.
So in my case, just in this example,
I'll say read followed by the view name
that we previously set up.
So that was help desk.
And finally, we can see the access option
and that's going to allow us to point
to our access control list.
So we can say, access one,
because that is the number for our already created ACL.
We can hit Enter to complete that command.
Now, we need to set up a username that a SNMP manager
is going to use in order to communicate with us.
We can do that with the command snmp-server user.
And if we look at contextual help
we can indicate the name of the user.
I'll say, Charles here.
And then we need to specify the group
to which the user will belong.
Remember, we created the group
and we named that admin earlier, so I'll use admin here.
Contextual help again, indicates we need to choose
our security model for this user
which of course we want to set to v3
because we're using SNMP version three.
Now, we look at our contextual help once more.
We'll see some additional options for the user.
Remember, that with this security model,
we want to use authentication and encryption
so we'll need to configure both of those.
We'll start with the authentication
by using the auth keyword
and you can see from contextual help
that we can use either MD5 or SHA for this authentication.
SHA is going to be the stronger recommended option,
so I'll say, SHA.
And now, we need to create an authentication password.
I'll use a really simple one in this example,
I'll just make that Cisco.
And again, contextual help tells us that we're down
to our encryption parameters now.
So we'll use that priv keyword
and the options under there are going to indicate
that we can use DES, 3DES, or AES.
And AES is of course the preferred option here.
It's the strongest option.
And then we can set the modulus for that.
I'll go with the strongest option of AES 256.
Finally, we need to set a privacy password as well.
I'll make that security here.
And then again, one last thing we need to do is to point
that to our access control list that's in place.
So I'll say, access one.
And that's going to point to access control list number one.
And I'll hit Enter to complete that command.
But that's a really, really long command
with lots of options in there.
Lots of options added into SNMP version three.
We want to make sure that we set up the same username,
authentication and encryption parameters,
and passwords, on the SNMP manager as well,
to make sure they we're able to communicate properly.
One more command that we want to look at is to identify
the SNMP manager by its IP address.
So we can say, snmp-server host,
and then you see that we can do that by its IP address
in our topology from which you can see on the screen.
It's 50.1.1.5, and if we look at our contextual help,
notice that we can choose either informs or traps.
If we choose informs, that's going to send both informs
and traps, while the traps keyword, that's the older option.
So for us, let's choose informs and take advantage
of that added feature of SNMP version three.
And now, we can look at contextual help again,
and we can use the keyword, version, to set our version.
And from help, you can see that we have those same version
options, one, two C, and three.
We want to use the number three
here of course, for SNMP version three.
And now, we can choose our security level.
We want to choose the priv option
because that is the strongest security level.
Now, we again need to create a username.
I'll set this one to Charles as well.
And if we look at our help options,
remember, we've seen this before when configuring
SNMP version two, by default all of the traps
are going to be allowed.
But if we want to narrow that down,
we can use these keywords to do so.
In our case, we'll accept those.
I'll break out of this.
We'll accept the default of allowing all traps
by simply hitting Enter.
And that is going to complete our configuration.
Again, you want to mirror this on any other SNMP
agent devices and of course on the SNMP manager
to make sure that everything is communicating
as you would expect.
So that's a look at configuring SNMP version three.