MIB Viewer

Cisco

SNMP configuration on Cisco gear centers on the snmp-server command family - but the exact syntax and capabilities differ meaningfully between classic IOS, IOS-XE, NX-OS, and ASA, covered at the end of this guide.

SNMPv2c (community strings)

configure terminal
snmp-server community public RO
snmp-server community secretstring RW
snmp-server location "Rack 4, DC1"
snmp-server contact admin@example.com
end

RO and RW control read-only vs. read-write access. Restricting a community to specific source addresses with a standard ACL is worth doing on anything internet-reachable:

access-list 10 permit 10.0.0.0 0.0.0.255
snmp-server community public RO 10

SNMPv3

SNMPv3 uses groups (which define a security level and view permissions) and users (which belong to a group):

snmp-server group MYGROUP v3 priv
snmp-server user MYUSER MYGROUP v3 auth sha MYAUTHPASS priv aes 128 MYPRIVPASS

v3 priv on the group requires both authentication and encryption (authPriv); auth instead of priv would require authentication only, and noauth neither - matching community-string-level security.

Sending traps

snmp-server enable traps
snmp-server host 192.168.1.100 version 2c public
snmp-server host 192.168.1.100 version 3 priv MYUSER

snmp-server enable traps with no further arguments enables the full default set; it also accepts specific trap categories (snmp-server enable traps snmp linkdown linkup) if you want to be selective rather than sending everything.

Platform differences

  • IOS-XE - the syntax above applies essentially unchanged; IOS-XE is close enough to classic IOS for SNMP purposes that most guides don't distinguish between them.
  • NX-OS (Nexus) - a real syntax difference here: rather than a simple RO/RW keyword, NX-OS maps a community directly to an RBAC role: snmp-server community public group network-operator. The group name refers to a role defined under NX-OS's own role-based access control system, not a simple read/write flag.
  • ASA (firewalls) - older ASA/PIX code only supports SNMPv1; SNMPv2c and SNMPv3 were added in later releases. If a community string configured the IOS way doesn't seem to work on an ASA, checking the code version against what that release actually supports is the first thing to check.