Now we move on and implement SNMP v3 on the Cisco iOS platform.
As we go through the SNMP v3 configuration,
we're going to go more in depth with SNMP views and the different types
of SNMP security available to us on the iOS platform.
So we'll go back into configuration mode.
The first thing we're going to do is use some of the SNMP MIB
views that we discussed in the previous clip.
So we will do snmp-server, we will do view,
and we have to give it the name of a view,
so in this case,
we'll name this one NORMAL and we have to tell it what MIB
family we're going to include or exclude.
In this case, we're going to include everything.
So we'll start with iso and we say whether it's included or excluded.
In this case, we're going to include iso and the normal SNMP view.
Now this is not a required step unless you're going to restrict the view.
If you don't specify an SNMP view, by default,
the SNMP v3 user can see everything.
So as an example, let's create a restricted view.
So we'll do snmp-server view, we'll name it RESTRICTED,
and in this case,
we'll say that it can only access the system information
such as the system name and location, etc,
but it cannot access any other information about the host.
Next, if we're going to do SNMP v3 permissions,
we have to create groups to bind these MIB views too.
So we'll do that with the snmp-server group command,
we give the name of a group, in this case,
we'll call the group MONITORING, we'll say that it's a v3 group.
You can technically create groups for SNMP v1 and v2c,
but since the security models in those versions of the
protocol are simply non-existent, they really only make sense for SNMP v3.
Now we get into the three security levels for SNMP v3.
You have the auth security level which corresponds to the
auth no priv security level in SNMP v3.
This requires a valid username and password,
but does not do any privacy or an encryption across the wire.
Then we have the priv group in Cisco which corresponds to
the auth priv security level in SNMP v3.
This requires authentication and privacy so it does both authentication
and encrypts the data as it goes across the wire.
Then finally, we have the no auth group,
which is the no auth, no priv security level in SNMP v3.
This essentially requires no username and password,
no encryption as it goes across the wire,
it essentially turns SNMP v3 into SNMP v2.
For our configuration,
we are going to use the auth group so that we don't do any encryption.
So we'll do auth on this level, and just like with SNMP v2,
you can specify an access list, you can do context and matching,
which we won't get into because, again, that's Cisco specific,
but near the bottom,
you'll notice that we have notify read and write where
we specify the views for this group.
In this case, we want it to both be able to read and write,
so we'll do read normal, write normal,
and there is not much else we can do with this.
We could send a notify view, but we're not going to be doing notifications,
so we'll hit Enter.
Now finally, we move onto configuring the SNMP v3 users.
We'll use the same SNMP server group of commands,
so snmp-server user, we give the name of the user,
in this case,
we'll name the user NORMAL to match the group that we're putting then,
the group to which the user belongs, NORMAL,
we then specify which security model we're using,
in this case, v3.
You can then also tie an access list to this specific user.
So if you have the specific user that's used on your network monitoring
platform and you only want that user to be able to log in from a
specific IP address or range of IP addresses,
you could create the access list and apply it here.
We're not going to do that.
We're just going to specify the auth parameters.
We have the option for MD5 or sha algorithms.
We'll use sha because it's a little more globally supported
and we need the password for the user, in this case,
we'll make the password CISCO.
After this, if we have chosen the privacy option for the group,
we would specify the encryption parameters for this user here at this command.
Since we have not done that, we'll just hit Enter.
Now we have an snmp-server user for this particular group.
Last, but not least,
we'll talk about how to enable server traps or
notifies as we talked about earlier.
We'll do snmp-server enable traps,
there's a whole host of items that you can enable here.
If you don't specify any of the groups,
it automatically enables it for everything.
So once we tell the router which traps we want to send,
we have to tell the router where to send those traps.
In this case, we'll do the snmp-server host command,
give it an IP address 192.168 .150 .5.
We're going to say we're going to send version 2 trap,
so we'll say version 2, and which community string we want to use,
in this case, traps only, and even at the host level,
we can configure what class of traps we sent.
This way, if we have multiple trap receivers,
we can send certain traps to one and certain trap to the other,
in this case, we're going to send everything,
so we'll just hit Enter and that tells it to send all
traps that are generated on this host,
which is all of them to 192.168 .150 .5 using the community string traps only.
Once we do this,
we'll write the configuration and that gets us configured for SNMP v3 on a Cisco iOS platform.