Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is the difference between SNMP v1, v2c and v3?
Short answer
SNMP versions differ in their security model. v1 (RFC 1157) and v2c (RFC 1901) are community-based: access is with a shared community name, and the traffic is not encrypted; compared with v1, v2c brings bulk queries (GetBulk) and more detailed error reporting. v3 (RFC 3414) adds user-based security: authentication and optional encryption are performed for each user (authNoPriv, authPriv). In TR7, on the agent side, SNMPd V1, SNMPd V2 and SNMPd v3 are turned on separately; in v3, a User List is defined and SHA + AES (authPriv) or MD5 (authNoPriv) is selected as the Auth Protocol for each user. On the trap side, the SNMP Version list contains v1, v2c and v3; traps are sent while v1 or v2c is selected, and are not sent while v3 is selected. Therefore v2c is used for traps, and SNMPd v3 on the agent side for encrypted queries.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Settings → Device Management → Management Access → Edit → SNMP | SNMPd V1, SNMPd V2 (Community name), SNMPd v3 (User list: username, Auth protocol, password) | The versions the agent will accept; each is turned on with a separate switch |
| Settings → General Settings → Notification Management → SNMP settings | SNMP Version (v1, v2c, v3), SNMP Community Name, SNMP Extra Settings in v3 | The version and community of the traps |
Comparison
| v1 | v2c | v3 | |
|---|---|---|---|
| Authentication | Community | Community | User-based |
| Encryption | None | None | Present in authPriv |
| On the TR7 agent | SNMPd v1: fixed public, read-only | SNMPd v2: Community name, read-only | SNMPd v3: User list; SHA + AES (authPriv) or MD5 (authNoPriv), read-only |
| In TR7 traps | Sent | Sent | Not sent |
- In SNMPd v3, the password of a user for whom SHA + AES is selected is used both in authentication and in encryption; a query example is given in the info text in the form:
snmpwalk -v3 -l authPriv -u $USERNAME -a SHA -A $USER_PASSWORD -x AES -X $USER_PASSWORD $IP:$PORT .1. - When SNMP version v3 is selected, the SNMP Community Name field is hidden and the SNMP Extra Settings field opens.
Common Misconceptions
- "v2c is an encrypted version." v2c, too, is community-based and does not encrypt the traffic.
- "Selecting v3 provides encryption in every case." Only authPriv (SHA + AES) encrypts; MD5 (authNoPriv) only authenticates.
- "Turning on SNMPd v3 on the agent also makes the traps v3." The agent versions and the trap version are separate settings; traps are sent with the SNMP version in SNMP settings, and v1 or v2c is selected.
How it is done in the documentation
