In contrast to SNMPv1 and SNMPv2, SNMP version 3 (SNMPv3) supports authentication and privacy (encryption) for the communication between the SNMP server and the managed devices. SNMPv3 uses the User-Based Security Model (USM) for message security (encryption and authentication if required). It also uses the View-Based Access Control Model (VACM) for access control, determining what information from the managed devices, specific users or group of users can access. For more information regarding SNMPv3 support in the SRX, refer to SNMPv3 Overview.

This configuration example contains the SNMP related commands needed to read and write information to and from the Junos device via the SNMPv3 protocol. It does not include configuration related to SNMPv3 traps/notifications that are unsolicited messages sent from the Junos device to the SNMP server upon the occurrence of certain events.

In this article, four users will be created with the characteristics mentioned below. In addition, these users will be grouped and provided with full access to the Junos device's information.

• User “NOAUTH” will not use any encryption nor authentication when polling information from the the Junos device via SNMP.
• User “AUTHNOPRIV” will use authentication but no encryption when polling information from the the Junos device via SNMP.
• User “AUTHPRIV” will use both, authentication and encryption, when polling information from the the Junos device via SNMP.
• User “NOSNMPV3” will be created for backwards compatibility with SNMPv2 protocol and because of this, it will only support authentication via a community string shared in clear text.

Note: The SNMPv3 configuration in this example also applies to other Junos devices; however, the configuration for the zones is only needed if the device is SRX. For switches/routers, make sure that you have opened SNMP in the lo0 filter.

Topology

Configuration

1. Create users.

   set snmp v3 usm local-engine user NOAUTH authentication-none
   
   set snmp v3 usm local-engine user AUTHNOPRIV authentication-md5 authentication-password JTACTEST
   set snmp v3 usm local-engine user AUTHNOPRIV privacy-none
   
   set snmp v3 usm local-engine user AUTHPRIV authentication-md5 authentication-password JTACTEST
   set snmp v3 usm local-engine user AUTHPRIV privacy-des privacy-password JTACTEST
   

   Note: user “NOSNMPV3” is not a SNMPv3 user and will not use the USM security model; there is no need to create it under this hierarchy.
    

2. Group all four users in a group named SNMPV3GROUP.

   set snmp v3 vacm security-to-group security-model v2c security-name NOSNMPV3 group SNMPV3GROUP
   set snmp v3 vacm security-to-group security-model usm security-name NOAUTH group SNMPV3GROUP
   set snmp v3 vacm security-to-group security-model usm security-name AUTHNOPRIV group SNMPV3GROUP
   set snmp v3 vacm security-to-group security-model usm security-name AUTHPRIV group SNMPV3GROUP

   Note: User “NOSNMPV3” is included in this group because they will share the same access privileges as the other users. However, it's security-model is V2C and not USM like the other users.
    

3. Create SNMP view that specifies that the users will be able to access all the Junos device's OIDs. For more information about SNMP views, refer to Configuring MIB Views.

   set snmp view SNMPVIEW oid .1 include

    
4. Specify that users of group SNMPV3GROUP will have read and write access to the information specified in view SNMPVIEW.

   set snmp v3 vacm access group SNMPV3GROUP default-context-prefix security-model any security-level none read-view SNMPVIEW
   set snmp v3 vacm access group SNMPV3GROUP default-context-prefix security-model any security-level none write-view SNMPVIEW
   set snmp v3 vacm access group SNMPV3GROUP default-context-prefix security-model any security-level authentication read-view SNMPVIEW
   set snmp v3 vacm access group SNMPV3GROUP default-context-prefix security-model any security-level authentication write-view SNMPVIEW
   set snmp v3 vacm access group SNMPV3GROUP default-context-prefix security-model any security-level privacy read-view SNMPVIEW
   set snmp v3 vacm access group SNMPV3GROUP default-context-prefix security-model any security-level privacy write-view SNMPVIEW
   

   Note: The above configuration specifies the read/write permission based on the following security-levels:

   • none: users part of group SNMPV3GROUP that do not use encryption nor authentication.
   • authentication: users part of group SNMPV3GROUP that use authentication only.
   • privacy: users part of group SNMPV3GROUP that use encryption and authentication.

5. Specify the community that will be used by user NOSNMPV3 that does not support SNMPv3 and will use SNMPv2.

   set snmp v3 snmp-community SNMPV3COMMUNITY community-name JTACCOMMUNITY
   set snmp v3 snmp-community SNMPV3COMMUNITY security-name NOSNMPV3
    

6. [If Junos device in an SRX] Enable SNMP protocol under Host-Inbound-Traffic in the security-zone where the SNMP messages are received by the SRX. For more information about Host-Inbound-Traffic, refer to Controlling Inbound Traffic Based on Traffic Types

   set security zones security-zone JTACZONE host-inbound-traffic system-services snmp
   
   

2020-07-11: Added note for non-SRX devices and replaced SRX with Junos device.
2020-03-27: ​Article reviewed for accuracy; it is valid and accurate