What is SNMPv3?
SNMPv3 is the current version of the Simple Network Management Protocol, which network management systems use to read status and counters from routers, switches, firewalls, printers and UPS units, and to receive notifications from them. It still uses UDP 161 for requests to the agent and UDP 162 for traps and informs sent to the manager. What changed is security. SNMPv1 and SNMPv2c authenticate with a community string, a shared password carried in cleartext in every packet, and many devices came configured with "public" for reading and "private" for writing. Anyone who sniffs or guesses a write community can reconfigure the device.
How SNMPv3 security works
SNMPv3, defined in RFCs 3411 to 3418, replaces community strings with named users under the User-based Security Model (USM), and the View-based Access Control Model (VACM) controls which data each user may read or change. Each message can be:
- Authenticated with an HMAC keyed from the user's authentication passphrase, so the agent knows who sent it and that nothing was altered. The original options were MD5 and SHA-1; later standards added SHA-2.
- Encrypted with keys derived from a separate privacy passphrase, originally DES and now normally AES-128.
- Checked for freshness against the agent's boot counter and clock, which limits replay of captured messages.
Three security levels combine these: noAuthNoPriv (a username only), authNoPriv (authentication without encryption) and authPriv (both). Only authPriv protects integrity and confidentiality together.
Example: an SNMPv3 user on a router
On Cisco IOS, a read-only monitoring user at the authPriv level might be configured like this:
snmp-server view MON-VIEW iso included
snmp-server group MON-RO v3 priv read MON-VIEW access 10
snmp-server user nms-poll MON-RO v3 auth sha <auth-passphrase> priv aes 128 <priv-passphrase>
no snmp-server community public
The priv keyword on the group requires authPriv, the view sets what the user can read, access list 10 limits which management stations may query the router, and the last line removes the default v2c community.
SNMPv3 vs. SNMPv2c
| SNMPv2c | SNMPv3 (authPriv) | |
|---|---|---|
| Authentication | Community string in cleartext | Per-user HMAC |
| Encryption | None | AES (DES on old devices) |
| Access control | Read-only or read-write community | Views per user or group |
Either version polls a device's state and counters and sends traps when something changes; the device's detailed log messages travel over syslog. Hardening means SNMPv3 with authPriv, SHA-2 and AES where the device supports them, read-only access unless writes are truly needed, queries restricted to the management network, and SNMP turned off where nothing polls it.
SNMPv3 on the CompTIA Security+ exam
SNMP is one of the monitoring protocols in SY0-801 objective 4.4, and questions about running it securely expect SNMPv3. Wording such as "monitor switches without sending credentials in cleartext," "secure network device polling" or "replace community strings" points to SNMPv3 with authPriv. Any answer that relies on a community string, however long, describes v1 or v2c and is not the secure choice. Know the ports, UDP 161 for polling and UDP 162 for traps, and remember that a question about collecting a device's log messages wants syslog, while one about polling status or receiving a trap wants SNMP.