24-4
Catalyst 4500 Series, Catalyst 2948G, Catalyst 2980G Switches Software Configuration Guide
—
Release 8.1
78-15486-01
Chapter 24 Configuring SNMP
Understanding How SNMP Works
Security Models and Levels
A security model is an authentication strategy that is set up for a user and the group in which the user
resides. A security level is the permitted level of security within a security model. A combination of a
security model and a security level will determine which security mechanism is employed when handling
an SNMP packet. Three security models are available: SNMPv1, SNMPv2c, and SNMPv3.
Table 24-2
identifies what the combinations of security models and levels mean.
Note the following about SNMPv3 objects:
•
Each user belongs to a group.
•
A group defines the access policy for a set of users.
•
SNMP objects refer to an access policy for reading, writing, and creating.
•
A group determines the list of notifications its users can receive.
•
A group also defines the security model and security level for its users.
SNMP ifindex Persistence Feature
The SNMP ifIndex persistence feature is always enabled. With the ifIndex persistence feature, the
ifIndex value of the port and VLAN is always retained and used after the following occurrences:
•
Switch reboot
•
High-availability switchover
•
Software upgrade
•
Module reset
•
Module removal and insertion of the same type of module
For Fast EtherChannel and Gigabit EtherChannel interfaces, the ifIndex value is only retained and used
after a high-availability switchover.
Table 24-2 Security Model Combinations
Model Level
Authentication Encryption What Happens
v1
noAuthNoPriv Community
String
No
Uses a community string match for authentication.
v2c
noAuthNoPriv Community
String
No
Uses a community string match for authentication.
v3
noAuthNoPriv Username
No
Uses a username match for authentication.
v3
authNoPriv
MD5 or SHA
No
Provides authentication based on the HMAC-MD5
or HMAC-SHA algorithms.
v3
authPriv
MD5 or SHA
DES
Provides authentication based on the HMAC-MD5
or HMAC-SHA algorithms. Provides DES 56-bit
encryption in addition to authentication based on
the CBC-DES (DES-56) standard.
