SNMPv1/v2c vs SNMPv3

Feature	SNMPv1 / SNMPv2c	SNMPv3
Security model	Community-based	User-based Security Model (USM)
Authentication	Shared community string	Individual users with cryptographic authentication
Credential protection	Community string is transmitted without cryptographic protection	Authentication using HMAC (SHA/MD5 depending on implementation)
Encryption	Not available	Optional encryption using DES/AES (AES recommended)
Access control	Basic community-based permissions	VACM-based access control with OID-level restrictions
Security level	No user identity verification	noAuthNoPriv / authNoPriv / authPriv

Why use SNMPv3?

1. Confidentiality

SNMPv1 and SNMPv2c do not provide encryption. Anyone who can capture SNMP traffic can read the monitoring data and potentially obtain the community string.

With SNMPv3 using authPriv, the SNMP traffic is encrypted using privacy protocols such as AES, making the exchanged information unreadable to unauthorized users.

2. Authentication and Message Integrity

SNMPv3 adds cryptographic authentication, allowing the device to verify that the request comes from a trusted monitoring system.

Available security levels:

• noAuthNoPriv — no authentication and no encryption
• authNoPriv — authentication without encryption
• authPriv — authentication with encryption

For production environments, authPriv is the recommended option.

3. Access Control

SNMPv3 provides more detailed access control through VACM (View-based Access Control Model).

Example configuration:

• Monitoring account with read-only permissions
• Access limited to required OIDs only (interfaces, CPU, memory, system information)
• No permission to modify device configuration

This follows the principle of least privilege and reduces the impact of credential compromise.

Summary

SNMPv1/v2c are based on a shared community string and provide no real security protection.

SNMPv3 adds:

• User-based authentication
• Message integrity verification
• Encryption support
• Granular access control using OID views

For production networks, SNMPv3 with authPriv, SHA authentication, and AES encryption should be the preferred configuration.